Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\awtfhidi.lnk
- <SYSTEM32>\tasks\opera scheduled autoupdate 1067970927
Malicious functions
Injects code into
the following user processes:
- aviuhhtb.exe
Modifies file system
Creates the following files
- %APPDATA%\microsoft\windows\awtfhidi\aviuhhtb.exe
Sets the 'hidden' attribute to the following files
- %APPDATA%\microsoft\windows\awtfhidi\aviuhhtb.exe
Deletes itself.
Network activity
Connects to
- 'ms###csi.com':80
TCP
HTTP GET requests
- http://www.ms###csi.com/ncsi.txt
UDP
- DNS ASK ke###ros.bit
Miscellaneous
Searches for the following windows
- ClassName: 'ConsoleWindowClass' WindowName: ''
Creates and executes the following
- '%APPDATA%\microsoft\windows\awtfhidi\aviuhhtb.exe'
- '%APPDATA%\microsoft\windows\awtfhidi\aviuhhtb.exe' ' (with hidden window)
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\taskeng.exe' {D0EE0F2B-C8C0-411F-8769-3DD3AF173024} S-1-5-21-2594934582-3011428313-3661137593-1000:eryixeq\user:Interactive:[1]
