Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = '"%WINDIR%\SysWow64\xntjw.exe" /shell'
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\explorer.exe
the following user processes:
- iexplore.exe
Modifies file system
Creates the following files
- %WINDIR%\syswow64\xntjw.exe
Deletes itself.
Network activity
TCP
Other
- '34.##9.100.209':443
UDP
- DNS ASK te#####lectrorealm.org
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\explorer.exe' "/executable"
