Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '09308eb47f75e68ea8a0420b1d22dfb1' = '%TEMP%\4UI4qoS6UeA8YW0Q.exe'
Modifies file system:
Moves itself:
- from <Full path to virus> to <Current directory>\4UI4qoS6UeA8YW0Q.exe
Network activity:
Connects to:
- 'www.xz##.com':80
TCP:
HTTP GET requests:
- http://www.xz##.com/upys/qdx.db
UDP:
- DNS ASK www.xz##.com
