Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\uMcg_x64] 'ImagePath' = '%TEMP%\DKVtUv.sys'
Creates the following services
- 'uMcg_x64' %TEMP%\DKVtUv.sys
Modifies file system
Creates the following files
- %TEMP%\dkvtuv.sys
Sets the 'hidden' attribute to the following files
- %TEMP%\dkvtuv.sys
Deletes the following files
- %TEMP%\dkvtuv.sys
Modifies the following files
Network activity
Connects to
- 'go##2.vip':80
- '23##.com':80
- '23##.com':443
- 'cr#.#igicert.cn':80
- 'oc##.#igicert.cn':80
- 'microsoft.com':80
TCP
HTTP GET requests
- http://www.go##2.vip/usamsg.txt
- http://www.go##2.vip/usaweb.txt
- http://oc##.#igicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQhnxEBNL9LgIhfSsTcHsrTt204QgQURNnISjOO01KNp5KUYR%2BayKW37MsCEAmXA3BU1Hq4%2BXERYZqPmak%3D
- http://cr#.#igicert.cn/DigiCertSecureSiteCNCAG3.crl
UDP
- DNS ASK go##2.vip
- DNS ASK 23##.com
- DNS ASK cr#.#igicert.cn
- DNS ASK oc##.#igicert.cn
- DNS ASK microsoft.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
