Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\software\Wow6432Node\microsoft\windows\CurrentVersion\Run] 'neme' = 'D:\ub\lasaa.exe'
Creates or modifies the following files
- <SYSTEM32>\tasks\î¢èГ
Malicious functions
Injects code into
the following user processes:
- lasaa.exe
Modifies file system
Creates the following files
- D:\ub\lasaa.exe
- D:\ub\md5.png
- D:\ub\autoip.dll
Network activity
TCP
- '10#.#49.107.30':8000
Miscellaneous
Searches for the following windows
- ClassName: 'CTXOPConntion_Class' WindowName: ''
Creates and executes the following
- 'D:\ub\lasaa.exe'
- '%WINDIR%\syswow64\cmd.exe' /c cmd.exe /c SCHTASKS /Create /SC ONSTART /TN "ГЋВўГ€Г" /TR "D:\ub\lasaa.exe"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c cmd.exe /c SCHTASKS /Create /SC ONSTART /TN "ГЋВўГ€Г" /TR "D:\ub\lasaa.exe"
- '%WINDIR%\syswow64\cmd.exe' /c SCHTASKS /Create /SC ONSTART /TN "ГЋВўГ€Г" /TR "D:\ub\lasaa.exe"
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC ONSTART /TN "ГЋВўГ€Г" /TR "D:\ub\lasaa.exe"
