Technical Information
To ensure autorun and distribution:
Creates the following files on removable media:
- <Drive name for removable media>:\Leeme.txt
Malicious functions:
Searches for registry branches where third party applications store passwords:
- [<HKCU>\Software\Microsoft\MessengerService]
Modifies file system :
Creates the following files:
- C:\Leeme.txt
Network activity:
Connects to:
- 'co###osweb.net':80
UDP:
- DNS ASK co###osweb.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: 'Z1S1BBCA:819F:214F:EC1A:K2A1A10Z358B'
