Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'sysconf32' = '%WINDIR%\sysconf32.vbs'
Modifies file system
Creates the following files
- %WINDIR%\sysconf32.vbs
Network activity
Connects to
- 'so#m.cz':80
- 'so#m.cz':443
- 'x1.#.lencr.org':80
TCP
HTTP GET requests
- http://www.so#m.cz/projects/webdoor/enter.php?cl###############
- http://x1.#.lencr.org/
Other
- 'so#m.cz':443
UDP
- DNS ASK so#m.cz
- DNS ASK x1.#.lencr.org
Miscellaneous
Searches for the following windows
- ClassName: 'Static' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\wscript.exe' "%WINDIR%\sysconf32.vbs"
Executes the following
- '%ProgramFiles%\internet explorer\iexplore.exe' -Embedding
- '<SYSTEM32>\wscript.exe' "%WINDIR%\sysconf32.vbs"' (with hidden window)
