Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '<File name>' = '%APPDATA%\<File name>.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\<File name>.exe
- <SYSTEM32>\tasks\<File name>
Creates the following files on removable media
- <Drive name for removable media>:\usb.exe
- <Drive name for removable media>:\router_manual.rtf.lnk
- <Drive name for removable media>:\pandp.rtf.lnk
- <Drive name for removable media>:\swc_2009-03-02.rdf.lnk
- <Drive name for removable media>:\elvisimp.rdf.lnk
- <Drive name for removable media>:\foaf.rdf.lnk
- <Drive name for removable media>:\contenttypes.rdf.lnk
- <Drive name for removable media>:\roozenedowebinar.pptx.lnk
- <Drive name for removable media>:\samieee_obiee_presentation.pptx.lnk
- <Drive name for removable media>:\sim_gametheory_to_finance.ppt.lnk
- <Drive name for removable media>:\accountsreceivable.ppt.lnk
- <Drive name for removable media>:\metac.ppt.lnk
- <Drive name for removable media>:\breakpoint.png.lnk
- <Drive name for removable media>:\cleanlyrics.png.lnk
- <Drive name for removable media>:\cbz.png.lnk
- <Drive name for removable media>:\background.png.lnk
- <Drive name for removable media>:\investmentbankca_ca8.pem.lnk
- <Drive name for removable media>:\ck.pem.lnk
- <Drive name for removable media>:\lom602.pdf.lnk
- <Drive name for removable media>:\fil_20060629111052.pdf.lnk
- <Drive name for removable media>:\fungalnameauthors.rtf.lnk
- <Drive name for removable media>:\pubnet_855.rtf.lnk
- <Drive name for removable media>:\krsweden.rtf.lnk
- <Drive name for removable media>:\military_callsigns_0311.rtf.lnk
- <Drive name for removable media>:\calculatorworksheet.zip.lnk
- <Drive name for removable media>:\excel_example.zip.lnk
- <Drive name for removable media>:\subjectclassification.zip.lnk
- <Drive name for removable media>:\removedtitles_records.zip.lnk
- <Drive name for removable media>:\price.zip.lnk
- <Drive name for removable media>:\contractualdeadlines.zip.lnk
- <Drive name for removable media>:\2013_smccc_competition_points_jul2013.xlsx.lnk
- <Drive name for removable media>:\cee_mmsprogram_summary_public.xlsx.lnk
- <Drive name for removable media>:\al.xlsx.lnk
- <Drive name for removable media>:\2013_finalsummaryforweb.xlsx.lnk
- <Drive name for removable media>:\suspendedcompanies.xlsx.lnk
- <Drive name for removable media>:\subjectclassification.xls.lnk
- <Drive name for removable media>:\excel_example.xls.lnk
- <Drive name for removable media>:\1sm_price.xls.lnk
- <Drive name for removable media>:\fiche_inscription_2015.xls.lnk
- <Drive name for removable media>:\babyboymaintoscenesbackground.wmv.lnk
- <Drive name for removable media>:\babyboymaintonotesbackground_pal.wmv.lnk
- <Drive name for removable media>:\passport_pal.wmv.lnk
- <Drive name for removable media>:\testwmv.wmv.lnk
- <Drive name for removable media>:\static_electricity_easy_and_quick_activities.rtf.lnk
- <Drive name for removable media>:\fiche_inscription_2015.zip.lnk
- <Drive name for removable media>:\spib_pima.pdf.lnk
- <Drive name for removable media>:\2015-02-worms-nanoparticle-toxicity.pdf.lnk
- <Drive name for removable media>:\2015-02-patients-topic-work-related-asthma-jobs.pdf.lnk
- <Drive name for removable media>:\tcm851ax32.exe.lnk
- <Drive name for removable media>:\hadac_newsletter_july_2010_final.docx.lnk
- <Drive name for removable media>:\glidescope_review_rev_010.docx.lnk
- <Drive name for removable media>:\adhd_and_obesity.docx.lnk
- <Drive name for removable media>:\cveuropeo.doc.lnk
- <Drive name for removable media>:\508softwareandos.doc.lnk
- <Drive name for removable media>:\lisp_success.doc.lnk
- <Drive name for removable media>:\hanni_umami_chapter.doc.lnk
- <Drive name for removable media>:\fi51.doc.lnk
- <Drive name for removable media>:\contosoroot_1.cer.lnk
- <Drive name for removable media>:\contoso.cer.lnk
- <Drive name for removable media>:\contosoroot.cer.lnk
- <Drive name for removable media>:\sdksampleunprivdeveloper.cer.lnk
- <Drive name for removable media>:\dashborder_120.bmp.lnk
- <Drive name for removable media>:\coffee.bmp.lnk
- <Drive name for removable media>:\dial.bmp.lnk
- <Drive name for removable media>:\dashborder_192.bmp.lnk
- <Drive name for removable media>:\toolbar.bmp.lnk
- <Drive name for removable media>:\join.avi.lnk
- <Drive name for removable media>:\skypesetup.exe.lnk
- <Drive name for removable media>:\notepad.exe.lnk
- <Drive name for removable media>:\advice_process.htm.lnk
- <Drive name for removable media>:\tree_view.htm.lnk
- <Drive name for removable media>:\clip_480_5sec_6mbps_h264.mp4.lnk
- <Drive name for removable media>:\d0068197bb5a41fea16a220c45390606.mp4.lnk
- <Drive name for removable media>:\51.mp4.lnk
- <Drive name for removable media>:\video.mp4.lnk
- <Drive name for removable media>:\spanner.mov.lnk
- <Drive name for removable media>:\13.jpg.lnk
- <Drive name for removable media>:\parnas_01.jpg.lnk
- <Drive name for removable media>:\pushkin.jpg.lnk
- <Drive name for removable media>:\210252809.jpg.lnk
- <Drive name for removable media>:\168.jpeg.lnk
- <Drive name for removable media>:\210252809.jpeg.lnk
- <Drive name for removable media>:\parnas_01.jpeg.lnk
- <Drive name for removable media>:\4f0bf7ff71f28.jpeg.lnk
- <Drive name for removable media>:\browse.html.lnk
- <Drive name for removable media>:\ituneshelpunavailable.html.lnk
- <Drive name for removable media>:\tree_view.html.lnk
- <Drive name for removable media>:\iisstart.html.lnk
- <Drive name for removable media>:\ituneshelpunavailable.htm.lnk
- <Drive name for removable media>:\about.htm.lnk
- <Drive name for removable media>:\browse.htm.lnk
- <Drive name for removable media>:\10thingscondoms.pdf.lnk
- <Drive name for removable media>:\price030215.zip.lnk
Modifies file system
Creates the following files
- %APPDATA%\<File name>.exe
Sets the 'hidden' attribute to the following files
- <Drive name for removable media>:\usb.exe
Network activity
Connects to
- 'ip##pi.com':80
- '45.#2.33.18':9887
TCP
HTTP GET requests
- http://ip##pi.com/line/?fi############
UDP
- DNS ASK ip##pi.com
Miscellaneous
Creates and executes the following
- '%APPDATA%\<File name>.exe'
- '<SYSTEM32>\schtasks.exe' /create /f /sc minute /mo 1 /tn "<File name>" /tr "%APPDATA%\<File name>.exe"' (with hidden window)
- '%APPDATA%\<File name>.exe' ' (with hidden window)
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /f /sc minute /mo 1 /tn "<File name>" /tr "%APPDATA%\<File name>.exe"
- '<SYSTEM32>\taskeng.exe' {413291E4-70FA-4603-B946-DE289D5E4FE0} S-1-5-21-1960123792-2022915161-3775307078-1001:uawduktxdo\user:Interactive:[1]
