Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'update' = '%APPDATA%\Microsoft\<File name>.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'update' = '%APPDATA%\Microsoft\<File name>.exe'
Creates or modifies the following files
- <SYSTEM32>\tasks\update
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
deletes volume shadow copies.
Modifies file system
Creates the following files
- %APPDATA%\microsoft\<File name>.exe
- z:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\desktop.ini
Sets the 'hidden' attribute to the following files
- z:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\desktop.ini
Network activity
Connects to
- '<LOCALNET>.23.1':445
- '<LOCALNET>.23.1':139
TCP
- 'ap#.#yip.com':443
UDP
- DNS ASK ap#.#yip.com
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\wbem\wmic.exe' SHADOWCOPY /nointeractive
- '<SYSTEM32>\vssvc.exe'
