Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '3eea96753a440f2f20b3f3c7bafd97b0' = '%TEMP%\6mq0Uem2IGA4mE6m.exe'
Modifies file system:
Moves itself:
- from <Full path to virus> to <Current directory>\6mq0Uem2IGA4mE6m.exe
Network activity:
Connects to:
- 'www.xz##.com':80
TCP:
HTTP GET requests:
- http://www.xz##.com/upys/qdx.db
UDP:
- DNS ASK www.xz##.com
