Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Wow6432Node\MICROSOFT\WINDOWS\CURRENTVERSION\RUN] 'SD_XRD' = 'C:\SD_XRD.exe'
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
blocks the following features:
- User Account Control (UAC)
Modifies file system
Creates the following files
- C:\sd_xrd.pic
- C:\libmysql50.dll
- C:\sd_xrd.exe
- %LOCALAPPDATA%\libmysql50.dll
Sets the 'hidden' attribute to the following files
- C:\sd_xrd.exe
- C:\libmysql50.dll
Network activity
UDP
- DNS ASK no#####eb2012.com.br
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'TabWindowClass' WindowName: ''
- ClassName: 'Shell DocObject View' WindowName: ''
- ClassName: 'Internet Explorer_Server' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'Frame Tab' WindowName: ''
- ClassName: 'MozillaWindowClass' WindowName: ''
Creates and executes the following
- 'C:\sd_xrd.exe'
