Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule action=allow profile=any protocol=any enable=yes direction=out name=Win2y2 program="%PROGRAM_FILES%\Internet Explorer\iexplore.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule action=allow profile=any protocol=any enable=yes direction=in name=Win2y2 program="%PROGRAM_FILES%\Internet Explorer\iexplore.exe"
- '<SYSTEM32>\wscript.exe' "%TEMP%\tmp3.vbs"
- '<SYSTEM32>\notepad.exe'
Injects code into
the following system processes:
- <SYSTEM32>\notepad.exe
Modifies file system :
Creates the following files:
- %TEMP%\2O0k35
- %TEMP%\sevane.tmp
- %APPDATA%\WindowsSystem\gfxdrv.exe
- %TEMP%\tmp3.vbs
Deletes the following files:
- %TEMP%\tmp3.vbs
Network activity:
Connects to:
- 'st####0.no-ip.org':1158
UDP:
- DNS ASK st####0.no-ip.org
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''
