Technical Information
Malicious functions:
Creates and executes the following:
- <Full path to virus>.exe /arg_oko
Executes the following:
- <SYSTEM32>\netsh.exe fIrEwaLl AdD AllOWeDPrOgrAm naMe="FlashFXP OKO" prOGram="<SYSTEM32>\svchost.exe" mode=ENABLE
- <SYSTEM32>\netsh.exe fIrEwaLl AdD pOrToPEnIng tcP 8085 "GateOKO" eNABLe
- <SYSTEM32>\reg.exe aDd "hklm\SOFTWARE\Microsoft\Internet Explorer\Main" /v TP /t ReG_Sz /d 1000 /f
- <SYSTEM32>\cmd.exe /c ""<Full path to virus>.exe" /arg_oko > ""%TEMP%\o6ko.bat"""
- <SYSTEM32>\cmd.exe /c ""%TEMP%\o6ko.bat""
Modifies file system :
Creates the following files:
- <SYSTEM32>\o6ko.dll
- %TEMP%\o6ko.bat
- <Full path to virus>.exe
- <DRIVERS>\o6ko.sys
Network activity:
Connects to:
- 'localhost':8085
