Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '<File name>' = 'C:\Users\Public\<File name>.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\<File name>.lnk
Creates the following files on removable media
- <Drive name for removable media>:\usb.exe
- <Drive name for removable media>:\iisstart.htm.lnk
- <Drive name for removable media>:\garden.htm.lnk
- <Drive name for removable media>:\tree_view.html.lnk
- <Drive name for removable media>:\about.html.lnk
- <Drive name for removable media>:\trivial-merge.html.lnk
- <Drive name for removable media>:\adadsi.html.lnk
- <Drive name for removable media>:\browse.html.lnk
- <Drive name for removable media>:\alert.html.lnk
- <Drive name for removable media>:\pushkin.jpeg.lnk
- <Drive name for removable media>:\2.jpeg.lnk
- <Drive name for removable media>:\210252809.jpeg.lnk
- <Drive name for removable media>:\13.jpeg.lnk
- <Drive name for removable media>:\2.jpg.lnk
- <Drive name for removable media>:\pushkin.jpg.lnk
- <Drive name for removable media>:\parnas_01.jpg.lnk
- <Drive name for removable media>:\3.jpg.lnk
- <Drive name for removable media>:\spanner.mov.lnk
- <Drive name for removable media>:\scan.mov.lnk
- <Drive name for removable media>:\etc6_m_1.mov.lnk
- <Drive name for removable media>:\clip_480_5sec_6mbps_h264.mp4.lnk
- <Drive name for removable media>:\video_1.mp4.lnk
- <Drive name for removable media>:\51.mp4.lnk
- <Drive name for removable media>:\video.mp4.lnk
- <Drive name for removable media>:\10thingscondoms.pdf.lnk
- <Drive name for removable media>:\2015-02-patients-topic-work-related-asthma-jobs.pdf.lnk
- <Drive name for removable media>:\spib_pima.pdf.lnk
- <Drive name for removable media>:\ff_ot_user_guide.pdf.lnk
- <Drive name for removable media>:\ck_ugo.pem.lnk
- <Drive name for removable media>:\server.pem.lnk
- <Drive name for removable media>:\ituneshelpunavailable.htm.lnk
- <Drive name for removable media>:\cert.pem.lnk
- <Drive name for removable media>:\64bit_notes.htm.lnk
- <Drive name for removable media>:\skypesetup.exe.lnk
- <Drive name for removable media>:\delete.avi.lnk
- <Drive name for removable media>:\join.avi.lnk
- <Drive name for removable media>:\000814251_video_01.avi.lnk
- <Drive name for removable media>:\correct.avi.lnk
- <Drive name for removable media>:\dashborder_120.bmp.lnk
- <Drive name for removable media>:\coffee.bmp.lnk
- <Drive name for removable media>:\tileimage.bmp.lnk
- <Drive name for removable media>:\dashborder_192.bmp.lnk
- <Drive name for removable media>:\default.bmp.lnk
- <Drive name for removable media>:\toolbar.bmp.lnk
- <Drive name for removable media>:\dashborder_96.bmp.lnk
- <Drive name for removable media>:\dial.bmp.lnk
- <Drive name for removable media>:\contosoroot_1.cer.lnk
- <Drive name for removable media>:\testcertificate.cer.lnk
- <Drive name for removable media>:\contosoroot.cer.lnk
- <Drive name for removable media>:\sdksampleunprivdeveloper.cer.lnk
- <Drive name for removable media>:\hanni_umami_chapter.doc.lnk
- <Drive name for removable media>:\weeklysheet1215.doc.lnk
- <Drive name for removable media>:\lisp_success.doc.lnk
- <Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc.lnk
- <Drive name for removable media>:\nwfieldnotes1966.docx.lnk
- <Drive name for removable media>:\hadac_newsletter_july_2010_final.docx.lnk
- <Drive name for removable media>:\file_p_00000000_1371597592.docx.lnk
- <Drive name for removable media>:\sdszfo.docx.lnk
- <Drive name for removable media>:\adhd_and_obesity.docx.lnk
- <Drive name for removable media>:\issi2013_template_for_posters.docx.lnk
- <Drive name for removable media>:\aoc_saq_d_v3_merchant.docx.lnk
- <Drive name for removable media>:\thlps_keeper_mayer_1965.docx.lnk
- <Drive name for removable media>:\dotnetfx45_full_setup.exe.lnk
- <Drive name for removable media>:\tree_view.htm.lnk
- <Drive name for removable media>:\delongcacert.pem.lnk
Malicious functions
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
Modifies file system
Creates the following files
- C:\users\public\<File name>.exe
Sets the 'hidden' attribute to the following files
- <Drive name for removable media>:\usb.exe
Deletes the following files
- C:\users\public\<File name>.exe
Substitutes the following files
- C:\users\public\<File name>.exe
Network activity
Connects to
- 'ip##pi.com':80
TCP
HTTP GET requests
- http://ip##pi.com/line/?fi############
UDP
- DNS ASK ip##pi.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '<Full path to file>'' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '<File name>.exe'' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\<File name>.exe'' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '<Full path to file>'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '<File name>.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\<File name>.exe'
