Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A80NY56E-AY7D-M58J-D8P5-2O188V1G05NC}] 'StubPath' = '"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe"'
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe
Network activity
UDP
- DNS ASK pu####ato.zapto.org
Miscellaneous
Executes the following
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe'
