Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'Policies' = '%APPDATA%\efwriavt\iivggiaw.exe'
Malicious functions:
Executes the following:
- '<SYSTEM32>\svchost.exe'
Hides the following processes:
- <Full path to virus>
Modifies file system:
Creates the following files:
- %APPDATA%\efwriavt\iivggiaw.exe
Sets the 'hidden' attribute to the following files:
- %APPDATA%\efwriavt\iivggiaw.exe
Network activity:
Connects to:
- 'lo###or2608.com':80
- 'www.ms#.com':80
TCP:
HTTP GET requests:
- http://www.ms#.com/
HTTP POST requests:
- http://lo###or2608.com/index.php
UDP:
- DNS ASK lo###or2608.com
- DNS ASK www.ms#.com
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: 'gQHdkhenieJv'
- ClassName: '' WindowName: 'wXxTjwiFgF'
- ClassName: '' WindowName: 'rmqv f yl'
- ClassName: '' WindowName: 'fYLfefx'
- ClassName: '' WindowName: 'ozUiPtrnoM'
- ClassName: '' WindowName: ' ismx dJ'
- ClassName: '' WindowName: 'FyaVpJx'
- ClassName: '' WindowName: ' qrXLO'
- ClassName: '' WindowName: 'tz CfRKzoketGawew'
- ClassName: '' WindowName: 'rj t u'
- ClassName: '' WindowName: 'tuZfyNtD'
- ClassName: '' WindowName: 'bVQrCGA lt'
- ClassName: '' WindowName: ' VfKo'
- ClassName: '' WindowName: 'NWL'
- ClassName: '' WindowName: 'pA '
- ClassName: '' WindowName: 'jv bnK'
- ClassName: '' WindowName: 'qJbfUiR g'
- ClassName: '' WindowName: 'hSBskyz '
- ClassName: '' WindowName: 'if pr'
- ClassName: '' WindowName: 'i pz'
- ClassName: '' WindowName: 'IhDvJlkZ'
- ClassName: '' WindowName: 'vzC aNS'
- ClassName: '' WindowName: 'Rwuk'
- ClassName: '' WindowName: 'VdktsJd'
- ClassName: '' WindowName: ' tb Yai'
- ClassName: '' WindowName: 'zrj oLzss'
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: 'EzWk yXdc'
- ClassName: '' WindowName: 'ua ICy pXd kY'
- ClassName: '' WindowName: 'C QfDe NX PFg'
- ClassName: '' WindowName: 'kqXEy wUHy mcNrxpGr'
- ClassName: '' WindowName: ' iGXNTl'
- ClassName: '' WindowName: 'YfwdnK w'
- ClassName: '' WindowName: 'vcdhyuNy nn'
- ClassName: '' WindowName: 'uKe Iefc'
- ClassName: '' WindowName: 'n uQwizNfiq'
- ClassName: '' WindowName: 'ucQvXvyAxpohrn'
- ClassName: '' WindowName: 'jgVSrqGIfy'
- ClassName: '' WindowName: 'gru ooQ'
- ClassName: '' WindowName: 'ta radicX'
- ClassName: '' WindowName: 'ajkeewAgdM'
- ClassName: '' WindowName: 'BrGEqm KjLNv'
- ClassName: '' WindowName: 'qufPlIc'
- ClassName: '' WindowName: 'lj '
- ClassName: '' WindowName: 'vpzffi'
- ClassName: '' WindowName: 'ygJXdhKZn'
- ClassName: '' WindowName: 'qp cj'
- ClassName: '' WindowName: 'UfmQcg o uyZDg'
- ClassName: '' WindowName: 'rZ letwtM'
- ClassName: '' WindowName: 'kvWla '
- ClassName: '' WindowName: 'pTcpKm '
- ClassName: '' WindowName: 'dztilU dk'
- ClassName: '' WindowName: 'j l ljlPkbkk '
- ClassName: '' WindowName: 'U ejOgjxmAhNez'
- ClassName: '' WindowName: 'xtVonvbN '
- ClassName: '' WindowName: 'lFrTEwnJ'
- ClassName: '' WindowName: 'p Wi n zWo'
- ClassName: '' WindowName: 'pgvnklO'
- ClassName: '' WindowName: 'esXHfa'
- ClassName: '' WindowName: 'h hbu heGBc '
- ClassName: '' WindowName: 'HuHxhwyrevwbLY'
- ClassName: '' WindowName: 'LkJ guasan wWJsE'
- ClassName: '' WindowName: 'Iw tU'
- ClassName: '' WindowName: 'aWJ yBbhahd'
- ClassName: '' WindowName: 'rF FkRDR ajykO '
- ClassName: '' WindowName: 'yMavwyak'
- ClassName: '' WindowName: ' GLfxobf'
- ClassName: '' WindowName: 'm Fgjuub'
- ClassName: '' WindowName: 'vcNyRolu '
- ClassName: '' WindowName: 'j qNL'
- ClassName: '' WindowName: 'Sglot '
- ClassName: '' WindowName: 'splsvJ'
- ClassName: '' WindowName: 'myzeuZsRo '
- ClassName: '' WindowName: 'CqBi Hfhcmqsx'
- ClassName: '' WindowName: 'rzqkGklEi'
- ClassName: '' WindowName: 'XmuB a jwib'
- ClassName: '' WindowName: 'upAi '
- ClassName: '' WindowName: 'kuv'
