Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Helper' = 'wscript.exe "%LOCALAPPDATA%\Google\Chrome\User Data\profile.js"'
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
Modifies file system
Creates the following files
- %LOCALAPPDATA%\google\chrome\user data\profile.js
Network activity
TCP
HTTP GET requests
- http://le####nternet.com/txt.txt
UDP
- DNS ASK le####nternet.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\wscript.exe' "<PATH_SAMPLE>.js" "usb"' (with hidden window)
Executes the following
- '<SYSTEM32>\wscript.exe' "<PATH_SAMPLE>.js" "usb"
