Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{C9E9A340-D1F1-11D0-821E-BIFROST999999}] 'stubpath' = '<SYSTEM32>\dllcache\fudeu.exe s'
- [<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{43EB5254-E4B3-4E69-6484-8E4E2C23A78E}] 'StubPath' = '<Full path to virus>'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Oddysee] 'ImagePath' = '<SYSTEM32>\ntoskrnl.exe:kernel'
Malicious functions:
Creates and executes the following:
- '<SYSTEM32>\oddysee.exe' -rk Oddysee
- '<SYSTEM32>\oddysee.exe' -rk {C9E9A340-D1F1-11D0-821E-BIFROST999999}
- '<SYSTEM32>\oddysee.exe' -i
- '<SYSTEM32>\oddysee.exe' -pnm explorer.exe
Executes the following:
- '<SYSTEM32>\net1.exe' start Oddysee
- '<SYSTEM32>\oddysee.exe' -pnm explorer.exe
- '%ProgramFiles%\Internet Explorer\IEXPLORE.EXE'
- '<SYSTEM32>\oddysee.exe' -rk {C9E9A340-D1F1-11D0-821E-BIFROST999999}
- '<SYSTEM32>\oddysee.exe' -rk Oddysee
- '%ProgramFiles%\Internet Explorer\IEXPLORE.EXE' -nohome
- '%WINDIR%\explorer.exe'
- '<SYSTEM32>\net.exe' start Oddysee
- '<SYSTEM32>\oddysee.exe' -i
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
Hooks the following functions in System Service Descriptor Table (SSDT):
- NtQuerySystemInformation, handler: kernel
- NtEnumerateValueKey, handler: kernel
- NtEnumerateKey, handler: kernel
Hides the following processes:
- %WINDIR%\explorer.exe
- %ProgramFiles%\Internet Explorer\IEXPLORE.EXE
Modifies file system:
Creates the following files:
- <SYSTEM32>\ntoskrnl.exe:kernel
- <SYSTEM32>\dllcache\fudeu.exe
- <SYSTEM32>\dllcache\ntkrnlmp.exe.new
- <SYSTEM32>\oddysee.exe
- <SYSTEM32>\ssvschost.sys
- %APPDATA%\addon.dat
Sets the 'hidden' attribute to the following files:
- %APPDATA%\addon.dat
- <SYSTEM32>\dllcache\fudeu.exe
Network activity:
Connects to:
- 'na#####nta3.no-ip.org':1201
- 'my#####og.dyndns.org':1201
- 'na#####nta1.no-ip.org':1201
- 'na#####nta2.no-ip.org':1201
- 'na#####nta1.no-ip.org':2201
- 'my#####og.dyndns.org':2201
- 'na#####nta3.no-ip.org':2201
- 'na#####nta2.no-ip.org':2201
UDP:
- DNS ASK na#####nta2.no-ip.org
- DNS ASK na#####nta3.no-ip.org
- DNS ASK my#####og.dyndns.org
- DNS ASK na#####nta1.no-ip.org
