Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '11f86284' = '%LOCALAPPDATA%\Amp\comhl.exe'
Modifies file system
Creates the following files
- %LOCALAPPDATA%\amp\comhl.exe
- %LOCALAPPDATA%\amp\zcomhl.exe
- %LOCALAPPDATA%\amp\log.dat
Network activity
TCP
HTTP POST requests
- http://www.se###stival.com/wp-content/plugins/WPSecurity/load.php
- http://nm####rdesign.lu/wp-content/plugins/WPSecurity/load.php
UDP
- DNS ASK se###stival.com
- DNS ASK nm####rdesign.lu
Miscellaneous
Creates and executes the following
- '%LOCALAPPDATA%\amp\comhl.exe'
- '%WINDIR%\syswow64\cmd.exe' /c type "<Full path to file>" > "%LOCALAPPDATA%\Amp\comhl.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c type "<Full path to file>" > "%LOCALAPPDATA%\Amp\zcomhl.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c pushd %LOCALAPPDATA%\Amp & start comhl.exe & popd' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c type "<Full path to file>" > "%LOCALAPPDATA%\Amp\comhl.exe"
- '%WINDIR%\syswow64\cmd.exe' /c type "<Full path to file>" > "%LOCALAPPDATA%\Amp\zcomhl.exe"
- '%WINDIR%\syswow64\cmd.exe' /c pushd %LOCALAPPDATA%\Amp & start comhl.exe & popd
