Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'
Malicious functions
To bypass firewall, removes or modifies the following registry keys
- [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'EnableFirewall' = '00000000'
- [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Firewall
Injects code into
the following system processes:
- <SYSTEM32>\winlogon.exe
Modifies file system
Creates the following files
- <Current directory>\xea10.tmp.dll
- <Current directory>\xea30.tmp.exe
Deletes the following files
- <Current directory>\xea30.tmp.exe
- <Current directory>\xea10.tmp.dll
Network activity
UDP
- '<LOCALNET>..33.4':19898
- 'localhost':51974
Miscellaneous
Searches for the following windows
- ClassName: 'Button' WindowName: 'Start'
- ClassName: '' WindowName: ''
Creates and executes the following
- '<Current directory>\xea30.tmp.exe' -G98040699 -p448 -r -l<Current directory>\xEA10.tmp.dll
Executes the following
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "<Full path to file>"
