Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'worm, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null' = 'file:///C:/gvof/<File name>.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft' = 'file:///C:/gvof/<File name>.exe'
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
Network activity
TCP
HTTP GET requests
- http://to#####runz.fileave.com/Attitude.exe
UDP
- DNS ASK to#####runz.fileave.com
