Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Windows System Flow' = '%TEMP%\BKUPtIcvOIyfno.exe'
Malicious functions
Injects code into
the following user processes:
- wingear.exe
Modifies file system
Creates the following files
- %TEMP%\bkupticvoiyfno.exe
- %TEMP%\wingear.exe
Network activity
UDP
- DNS ASK uk##.no-ip.org
Miscellaneous
Creates and executes the following
- '%TEMP%\bkupticvoiyfno.exe'
- '%TEMP%\wingear.exe'
