Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,<SYSTEM32>\mstap32.exe'
Creates the following files on removable media
- <Drive name for removable media>:\usbmon.exe
- <Drive name for removable media>:\autorun.inf
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Modifies file system
Creates the following files
- <SYSTEM32>\mstap32.exe
- <SYSTEM32>\htdns.dll
- <SYSTEM32>\msmon.exe
- %TEMP%\dbg.txt
- C:\usbmon.exe
- C:\autorun.inf
- D:\usbmon.exe
- D:\autorun.inf
Sets the 'hidden' attribute to the following files
- <SYSTEM32>\mstap32.exe
- <SYSTEM32>\htdns.dll
Network activity
UDP
- DNS ASK fr##8s.info
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\mstap32.exe'
