Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] 'Load' = '%APPDATA%\Microsoft\Speech\AudioDriver.exe'
Malicious functions
Injects code into
the following user processes:
- .exe
Modifies file system
Creates the following files
- %TEMP%\.exe
- %TEMP%\core.exe
- %TEMP%\ixp000.tmp\discor~1.exe
- %TEMP%\ixp000.tmp\eek.exe
- %APPDATA%\microsoft\speech\audiodriver.exe
Sets the 'hidden' attribute to the following files
- %APPDATA%\microsoft\speech\audiodriver.exe
Network activity
Connects to
- '<LOCALNET>.15.31':10134
UDP
- DNS ASK di####dada.ddns.net
Miscellaneous
Creates and executes the following
- '%TEMP%\.exe'
- '%TEMP%\ixp000.tmp\discor~1.exe'
- '%TEMP%\core.exe' -woohoo 1744 <Full path to file>
- '%APPDATA%\microsoft\speech\audiodriver.exe'
- '%TEMP%\ixp000.tmp\eek.exe'
