Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'MicrosoftSecure' = 'rundll32 C:\MicrosoftSecure.dll,DLLRegisterServer'
Network activity:
Connects to:
- 'pi#####orta.110mb.com':80
TCP:
HTTP POST requests:
- pi#####orta.110mb.com/paxa/contar.php
UDP:
- DNS ASK pi#####orta.110mb.com
