Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\software\microsoft\windows\currentversion\run] 'Windows Defender' = '%APPDATA%\oDkVaEdVqQoIuQmVlCxKrXsNdRaRxInRpIaIrCjToNgXlSfAqGyKeVtHmSwObXnNqUqCsPjM.exe'
Creates the following files on removable media
- <Drive name for removable media>:\jlavz.exe
- <Drive name for removable media>:\join.lnk
- <Drive name for removable media>:\000814251_video_01.lnk
- <Drive name for removable media>:\archer.lnk
Modifies file system
Creates the following files
- %APPDATA%\odkvaedvqqoiuqmvlcxkrxsndrarxinrpiaircjtongxlsfaqgykevthmswobxnnquqcspjm.exe
- %APPDATA%\microsoft\windows\start menu\programsexplorer.exe
- C:\<File name>.exe
Sets the 'hidden' attribute to the following files
- <Drive name for removable media>:\jlavz.exe
Substitutes the following executable files
- %HOMEPATH%\Desktop\calc.exe
- %HOMEPATH%\Desktop\jre-7u75-windows-i586-iftw.exe
- %HOMEPATH%\Desktop\notepad.exe
- %HOMEPATH%\Desktop\skypesetup.exe
- %HOMEPATH%\Desktop\utorrent.exe
- %HOMEPATH%\Desktop\winmine.exe
Network activity
UDP
- DNS ASK dl.##opbox.com
- DNS ASK au######on.whatismyip.com
