Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'System32' = '<Full path to file>'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'System32' = '%APPDATA%\<File name>.exe'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Mscvin' = '<SYSTEM32>\Mscvin.exe'
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Executes the following
- '%WINDIR%\syswow64\netsh.exe' firewall set opmode disable
- '%WINDIR%\syswow64\net.exe' stop security center
- '%WINDIR%\syswow64\net.exe' stop WinDefend
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe
Searches for registry branches where third party applications store passwords
- [HKCU\Software\Microsoft\Internet Account Manager]
- [HKLM\Software\Wow6432Node\Microsoft\Windows Mail]
- [HKCU\Software\Microsoft\Windows Mail]
Modifies file system
Creates the following files
- %TEMP%\aut7e05.tmp
- %TEMP%\1.resource
- %APPDATA%\<File name>.exe
- %TEMP%\aut8140.tmp
- %WINDIR%\syswow64\mscvin.exe
Sets the 'hidden' attribute to the following files
- <Full path to file>
- %APPDATA%\<File name>.exe
- %WINDIR%\syswow64\mscvin.exe
Deletes the following files
- %TEMP%\aut7e05.tmp
- %TEMP%\aut8140.tmp
Network activity
Connects to
- 'sm##.yandex.com':465
TCP
Other
- 'sm##.yandex.com':465
UDP
- DNS ASK sm##.yandex.com
- 'localhost':60529
- 'localhost':61017
Miscellaneous
Creates and executes the following
- '%APPDATA%\<File name>.exe'
Executes the following
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe'
- '%WINDIR%\syswow64\net1.exe' stop WinDefend
- '%WINDIR%\syswow64\net1.exe' stop security center
- '%WINDIR%\syswow64\netsh.exe' firewall set opmode disable' (with hidden window)
- '%WINDIR%\syswow64\net.exe' stop security center' (with hidden window)
- '%WINDIR%\syswow64\net.exe' stop WinDefend' (with hidden window)
