Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] '10' = '%WINDIR%\svchost.exe'
Modifies file system
Creates the following files
- %WINDIR%\svchost.exe
Network activity
Connects to
- 'ba##u.com':80
- 'rj.#ie6.cn':80
UDP
- DNS ASK ba##u.com
- DNS ASK rj.#ie6.cn
Miscellaneous
Creates and executes the following
- '%WINDIR%\svchost.exe'
