Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Microsoft' = '%TEMP%\<File name>.exe'
Malicious functions
Searches for registry branches where third party applications store passwords
- [<HKCU>\Software\Paltalk]
Modifies file system
Creates the following files
- %TEMP%\<File name>.exe
Deletes itself.
Network activity
TCP
HTTP GET requests
- http://www.my####y.net63.net/hobby/index.php?ac#############################################
- http://www.my####y.net63.net/hobby/index.php?ac####################################################################################################
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/02FAF3E291435468607857694DF5E45B68851868.crt
UDP
- DNS ASK my####y.net63.net
- DNS ASK 00###bhost.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%TEMP%\<File name>.exe'
