Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Skype Remote Control' = '<Full path to file>'
Creates or modifies the following files
- %TEMP%\dtwdsrfvpw
Modifies file system
Creates the following files
- %TEMP%\dtwdsrfvpw
Network activity
Connects to
- '10#.#55.137.18':443
- '19#.#23.240.6':443
- '86.##4.194.29':443
- '19#.#23.241.68':443
- '19#.#23.241.175':443
TCP
HTTP GET requests
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
UDP
- DNS ASK microsoft.com
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /c TIMEOUT /T 50 /NOBREAK && move "%TEMP%\dtwdsrfvpw" "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\Windows Control Panel.lnk"
- '<SYSTEM32>\timeout.exe' /T 50 /NOBREAK
