Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'shell' = '%TEMP%\IOaL3HY3\4XgAq0my.exe'
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v2.0.50727\regasm.exe
Modifies file system
Creates the following files
- %APPDATA%\6nnmvkrjj5.exe
- %TEMP%\ioal3hy3\4xgaq0my.exe
- %TEMP%\ussd.vbs
- %APPDATA%\36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee\run.dat
Network activity
Connects to
- 'by##ply.eu':1614
UDP
- DNS ASK by##ply.eu
Miscellaneous
Creates and executes the following
- '%APPDATA%\6nnmvkrjj5.exe'
- '%WINDIR%\syswow64\wscript.exe' "%TEMP%\USsD.vbs"
Executes the following
- '%WINDIR%\microsoft.net\framework\v2.0.50727\regasm.exe'
