Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\software\Wow6432Node\microsoft\windows\CurrentVersion\Run\] 'Microsoft' = '%WINDIR%\Microsoft.exe'
Modifies file system
Creates the following files
- %WINDIR%\r11.exe
- %WINDIR%\microsoft.exe
Sets the 'hidden' attribute to the following files
- %WINDIR%\microsoft.exe
Network activity
Connects to
- '11#.#2.91.212':6666
TCP
Other
- '11#.#2.91.212':6666
Miscellaneous
Creates and executes the following
- '%WINDIR%\r11.exe'
- '%WINDIR%\microsoft.exe'
