Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\cmd.exe' /c "%tEMP%\fio.Bat"
- '<SYSTEM32>\reg.exe' add "hklm\soFtWARe\miCRoSOfT\INTerNEt exPloREr\MAin" /v tp /t reg_sz /d 1000 /f
- '<SYSTEM32>\netsh.exe' fIrEwaLl AdD allowedprogram name="pdrv" program="<SYSTEM32>\SvchOst.eXE" mode=enable
- '<SYSTEM32>\cmd.exe' /c copy "<Full path to virus>" "<Full path to virus>.exe"
- '<SYSTEM32>\cmd.exe' /c "<Full path to virus>.exe" /res >%tEMP%\fio.Bat
- '<Full path to virus>.exe' /res
Modifies file system:
Creates the following files:
- <SYSTEM32>\pdrv.dll
- %TEMP%\fio.Bat
- <Full path to virus>.exe
- <DRIVERS>\pdrv.sys
Network activity:
Connects to:
- 'localhost':8085
