Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'SIROQTT' = '<SYSTEM32>\kvmyvje.exe'
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'EnableFirewall' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'DoNotAllowExceptions' = '00000000'
To complicate detection of its presence in the operating system,
blocks the following features:
- System File Checker (SFC)
- Windows Security Center
Executes the following:
- '<SYSTEM32>\netsh.exe' firewall set opmode mode=disable profile=all
- '<SYSTEM32>\sc.exe' config SharedAccess start= disabled
Hides the following processes:
- <Full path to virus>
Modifies file system :
Creates the following files:
- <SYSTEM32>\kvmyvje.exe
- <Full path to virus>
Modifies the HOSTS file.
Moves itself:
- from <Full path to virus> to %TEMP%\1.tmp
Network activity:
Connects to:
- 'ma##.#arthlink.net':25
- 'yu####z.1dumb.com':80
TCP:
HTTP GET requests:
- yu####z.1dumb.com/reg?u=##########################################################
- yu####z.1dumb.com/reg?u=#########################################################
UDP:
- DNS ASK jd####y.dynserv.com
- DNS ASK ma#####03.mx.aol.com
- DNS ASK wy####ow.afraid.org
- DNS ASK fc####ydw.yi.org
- DNS ASK nt###zi.hn.org
- DNS ASK yu####z.1dumb.com
- DNS ASK mx#.mail.ru
- DNS ASK ma##.#arthlink.net
- DNS ASK mc###i.3-a.net
- DNS ASK mx#.#otmail.com
