Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\] 'SQL Client Configuration Utility EXE' = '%APPDATA%\cliconfg.exe'
Malicious functions
Injects code into
the following user processes:
- cliconfg.exe
Modifies file system
Creates the following files
- %APPDATA%\cliconfg.exe
Sets the 'hidden' attribute to the following files
- %APPDATA%\cliconfg.exe
Network activity
UDP
- DNS ASK p1##x.cc
Miscellaneous
Creates and executes the following
- '%APPDATA%\cliconfg.exe'
Restarts the analyzed sample
Executes the following
- '%APPDATA%\cliconfg.exe' ' (with hidden window)
