Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Schedule] 'Start' = '00000002'
Malicious functions:
To complicate detection of its presence in the operating system,
modifies the following system settings:
- DNS server to '<DNS_SERVER>'
- DNS server to '223.5.5.5'
Network activity:
Connects to:
- '22#.#5.247.240':80
TCP:
HTTP GET requests:
- http://22#.#5.247.240/ok/ups.html
Miscellaneous:
Executes the following:
- '<SYSTEM32>\ping.exe' 127.0.0.1 -n 10
- '<SYSTEM32>\sc.exe' start xWinWpdSrv
- '<SYSTEM32>\cmd.exe' /c sc start xWinWpdSrv&ping 127.0.0.1 -n 10 && del <Full path to file> >> NUL
