Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'vlc' = '"%APPDATA%\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe"'
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe
Modifies file system
Creates the following files
- %TEMP%\macrium.reflect.(all.editions).7.2.3825.[x64]-mpt.exe
- %TEMP%\dup2patcher.dll
- %TEMP%\bassmod.dll
- %TEMP%\macrium.reflect.exe
- %TEMP%\7ceb9b2a0e395bd64e74381485a106af.dll
- %TEMP%\64f4ea4c8142cac73e06647d59a699d1.dll
- %TEMP%\berlin sans fb.ttf
- %APPDATA%\microsoft\windows\start menu\programs\videolan\vlc.exe
Network activity
Connects to
- 'ha###.mine.nu':1993
UDP
- DNS ASK ha###.mine.nu
Miscellaneous
Creates and executes the following
- '%TEMP%\macrium.reflect.(all.editions).7.2.3825.[x64]-mpt.exe'
- '%TEMP%\macrium.reflect.exe'
Executes the following
- '%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe'
