Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'df06637eee5d39f051315bfb50ff6c25' = '%TEMP%\ZRt95dxjxtRH917f.exe'
Modifies file system:
Moves itself:
- from <Full path to virus> to <Current directory>\ZRt95dxjxtRH917f.exe
Network activity:
Connects to:
- 'www.xz##.com':80
TCP:
HTTP GET requests:
- http://www.xz##.com/upys/qdx.db
UDP:
- DNS ASK www.xz##.com
