Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'kszzul_kys' = '%ALLUSERSPROFILE%\Microsoft\Network\netsvcs.exe'
Malicious functions
Executes the following
- '%ProgramFiles%\internet explorer\iexplore.exe' http://down.81830.info:802/ad2.htm?3___http://go.microsoft.com/fwlink/?LinkId=69157
Modifies file system
Creates the following files
- %TEMP%\aut4346.tmp
- %ALLUSERSPROFILE%\kcr.cate
Deletes the following files
- %TEMP%\aut4346.tmp
Network activity
UDP
- DNS ASK do##.81830.info
Miscellaneous
Searches for the following windows
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%ProgramFiles%\internet explorer\iexplore.exe' http://down.81830.info:802/ad2.htm?3___http://go.microsoft.com/fwlink/?LinkId=69157' (with hidden window)
