Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'LFSRb' = '%APPDATA%\LFSRb\LFSRb.exe'
Malicious functions
Creates and executes the following
- '' (downloaded from the Internet)
Creates and executes the following (exploit)
- '%APPDATA%\davinci2648.scr'
Injects code into
the following user processes:
- davinci2648.scr
Modifies file system
Creates the following files
- %APPDATA%\davinci2648.scr
- %APPDATA%\lfsrb\lfsrb.exe
Modifies the HOSTS file.
Network activity
Connects to
- '19#.#39.147.103':80
TCP
HTTP GET requests
- http://19#.#39.147.103/base/36CFBC8AC1A486B8BF4A7993A6962894.html
- http://19#.#39.147.103/base/BE9E07DA0BBF8C6680F94B3B8384CE96.html
- http://19#.#39.147.103/base/124F9A63ED84EEF7221014DB6DFD4AD5.html
UDP
- DNS ASK tu###inblog.com
Miscellaneous
Executes the following
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
