Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = 'userinit.exe,%PROGRAM_FILES%\WinRAR\conime.exe'
Malicious functions:
Creates and executes the following:
- %PROGRAM_FILES%\WinRAR\conime.exe kill 2788|<Full path to virus>
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\WinRAR\conime.exe
- %TEMP%\E_N4\krnln.fnr
Deletes itself.
Network activity:
Connects to:
- 'fa####1.3322.org':12345
UDP:
- DNS ASK fa####1.3322.org
