Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\AIDA64Driver] 'ImagePath' = '%TEMP%\kerneld.x64'
Creates the following services
- 'AIDA64Driver' %TEMP%\kerneld.x64
Modifies file system
Creates the following files
- %TEMP%\aida64.exe
- %TEMP%\7za.exe
- %TEMP%\a.7z
- %TEMP%\nsf5522.tmp\execdos.dll
- %TEMP%\lanbo.exe
Deletes the following files
- %TEMP%\nsf5522.tmp\execdos.dll
Network activity
UDP
- DNS ASK mo####imagehost.com
Miscellaneous
Creates and executes the following
- '%TEMP%\7za.exe' x "%TEMP%\a.7z" -pZ0aWUCpdnC -o"%TEMP%\" -aoa
- '%TEMP%\aida64.exe'
- '%TEMP%\lanbo.exe'
Executes the following
- '%TEMP%\7za.exe' x "%TEMP%\a.7z" -pZ0aWUCpdnC -o"%TEMP%\" -aoa' (with hidden window)
