Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Updating' = '%APPDATA%\Updating.exe'
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%APPDATA%\Updating.exe' = '%APPDATA%\Updating.exe:*:Enabled:Updating.e...
Executes the following:
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "%APPDATA%\Updating.exe" "Updating.exe" ENABLE
Modifies file system:
Creates the following files:
- %APPDATA%\Updating.exe
Network activity:
Connects to:
- '74.##5.232.51':80
- '00##.club':80
- 'sv####t.ddns.net':1177
- 'wp#d':80
TCP:
HTTP GET requests:
- http://00##.club/temp/o.txt
- http://www.google.com/ via 74.##5.232.51
- http://11#.#11.111.2/wpad.dat via wp#d
UDP:
- DNS ASK www.google.com
- DNS ASK 00##.club
- DNS ASK sv####t.ddns.net
- DNS ASK wp#d
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
Creates and executes the following:
- '%APPDATA%\Updating.exe'
