Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'aaa' = 'C:\Users\Public\regsvr32.exe'
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Moves itself
- from <Full path to file> to C:\users\public\<File name>.dll
Network activity
Connects to
- '43.##2.163.147':800
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\svchost.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\svchost.exe'
