Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer, %WINDIR%\\SysWOW64\\regsvr32.exe /s /n /u /i:"%LOCALAPPDATA%\network\image-network.png" scrobj.dll'
Malicious functions
Executes the following (exploit)
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 3124
Modifies file system
Creates the following files
- %LOCALAPPDATA%\network\image-network.png
- %TEMP%\450733.cvr
Network activity
Connects to
- 're###stbin.net':443
TCP
Other
- 're###stbin.net':443
UDP
- DNS ASK re###stbin.net
