Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'HKLM' = '%WINDIR%\InstallDir\Server.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'HKCU' = '%WINDIR%\InstallDir\Server.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5160702B-3LD0-WD55-6N7N-7548Y842BA67}] 'StubPath' = '%WINDIR%\InstallDir\Server.exe restart'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'HKCU' = '㩃停潲牧浡䘠汩獥⠠㡸⤶䥜瑮牥敮⁴硅汰牯牥楜硥汰牯硥e6엸က엸က㼔'
- [<HKLM>\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5160702B-3LD0-WD55-6N7N-7548Y842BA67}] 'StubPath' = '%WINDIR%\InstallDir\Server.exe'
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %WINDIR%\installdir\server.exe
Network activity
UDP
- DNS ASK n0##.zapot.org
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\svchost.exe'
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe'
