Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ducker' = '"%ProgramFiles%\Headlong\ewert.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'backflip' = '"<Full path to file>"'
Malicious functions:
Executes the following:
- '<SYSTEM32>\find.exe' /I "ewert.exe"
- '<SYSTEM32>\tasklist.exe' /NH /FI "IMAGENAME eq ewert.exe"
- '<SYSTEM32>\cmd.exe' /C <SYSTEM32>\tasklist /NH /FI "IMAGENAME eq ewert.exe" | <SYSTEM32>\find /I "ewert.exe"
Modifies file system:
Creates the following files:
- %TEMP%\nsb2.tmp\ExecCmd.dll
