Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\software\microsoft\windows\currentversion\run] 'IntelPowerAgent3' = 'rundll32.exe shell32.dll, ShellExec_RunDLL C:\PROGRA~3\D0BHJ2~1.EXE'
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
- %WINDIR%\syswow64\cmd.exe
the following user processes:
- iexplore.exe
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\d0bhj2468j.exe
- %APPDATA%\faub222.tmp.bat
Network activity
UDP
- DNS ASK vk.com
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\svchost.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\fauB222.tmp.bat" "<Full path to file>""
- '%WINDIR%\syswow64\svchost.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\fauB222.tmp.bat" "<Full path to file>""' (with hidden window)
