Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\word] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\word] 'ImagePath' = '<SYSTEM32>\svchost.exe -k word'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\word\Parameters\] 'ServiceDll' = '%ProgramFiles(x86)%\IRAT\IRAT.rmvb'
Creates the following services
- 'word' <SYSTEM32>\svchost.exe -k word
Malicious functions
Installs hooks to intercept notifications
on window messages:
- Handler for all processes: %ProgramFiles(x86)%\irat\irat.rmvb
Modifies file system
Creates the following files
- %ProgramFiles(x86)%\irat\irat.rmvb
- %TEMP%\1147324.bat
Sets the 'hidden' attribute to the following files
- %ProgramFiles(x86)%\irat\irat.rmvb
Deletes itself.
Network activity
Connects to
- 'gi####iend.3322.org':82
UDP
- DNS ASK gi####iend.3322.org
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\\1147324.bat' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\svchost.exe' -k word
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\\1147324.bat
