Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'apisroxy' = '%APPDATA%\Microsoft\Api-gIME\audinput.exe'
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\control.exe
- %WINDIR%\explorer.exe
- <SYSTEM32>\rundll32.exe
the following user processes:
- iexplore.exe
- firefox.exe
Hooks functions
in browsers
- firefox.exe process, nss3.dll module
Modifies file system
Creates the following files
- mailslot\msl0
- %APPDATA%\microsoft\api-gime\audinput.exe
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\prefs.js
Deletes itself.
Miscellaneous
Searches for the following windows
- ClassName: 'ProgMan' WindowName: ''
Executes the following
- '<SYSTEM32>\control.exe' /?
- '<SYSTEM32>\rundll32.exe' Shell32.dll,Control_RunDLL /?
- '<SYSTEM32>\cmd.exe' /C "nslookup myip.opendns.com resolver1.opendns.com > %TEMP%\AE2C.bi1"
- '<SYSTEM32>\cmd.exe' /C "nslookup myip.opendns.com resolver1.opendns.com > %TEMP%\E854.bi1"
- '<SYSTEM32>\nslookup.exe' myip.opendns.com resolver1.opendns.com
- '<SYSTEM32>\cmd.exe' /C "echo -------- >> %TEMP%\E854.bi1"
- '<SYSTEM32>\rundll32.exe' Shell32.dll,Control_RunDLL /?' (with hidden window)
