Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'versele' = '%HOMEPATH%\GENNEMTRAW\UNVENIABL.vbs'
Malicious functions
Injects code into
the following user processes:
- unveniabl.exe
Modifies file system
Creates the following files
- %HOMEPATH%\gennemtraw\unveniabl.exe
- %HOMEPATH%\gennemtraw\unveniabl.vbs
- %APPDATA%\cosp\dos.dt
Network activity
Connects to
- 'fu##676.com':2266
- 'co##ta66.gq':2266
TCP
- 'cd#.#ilesend.jp':443
UDP
- DNS ASK cd#.#ilesend.jp
- DNS ASK fu##676.com
- DNS ASK co##ta66.gq
- DNS ASK co##ta67.ga
- DNS ASK co##ta68.ga
- DNS ASK co##ta69.ga
- DNS ASK co##ta70.ga
Miscellaneous
Creates and executes the following
- '%HOMEPATH%\gennemtraw\unveniabl.exe'
