Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Firewall
deletes volume shadow copies.
Creates and executes the following (exploit)
- '%APPDATA%\svnhost.exe'
Creates and loads libraries (exploit)
- %APPDATA%\zvgpmzeaujxk.pwn
Executes the following
- '%WINDIR%\syswow64\net.exe' stop MpsSvc
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /C start /B "" "%APPDATA%\svnhost.exe"
Injects code into
the following system processes:
- %WINDIR%\syswow64\explorer.exe
the following user processes:
- svnhost.exe
Modifies file system
Creates the following files
- %APPDATA%\zvgpmzeaujxk.pwn
- %APPDATA%\svnhost.exe
Deletes the following files
- %APPDATA%\zvgpmzeaujxk.pwn
- %APPDATA%\svnhost.exe
Network activity
UDP
- DNS ASK so####sothat.com
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\explorer.exe'
- '%WINDIR%\syswow64\cmd.exe' /c sc config MpsSvc start= disabled
- '%WINDIR%\syswow64\cmd.exe' /c net stop MpsSvc
- '%WINDIR%\syswow64\sc.exe' config MpsSvc start= disabled
- '%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "%1"
- '%WINDIR%\syswow64\net1.exe' stop MpsSvc
- '<SYSTEM32>\cmd.exe' /C start /B "" "%APPDATA%\svnhost.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc config MpsSvc start= disabled' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net stop MpsSvc' (with hidden window)
- '%WINDIR%\syswow64\vssadmin.exe' delete shadows /all /quiet' (with hidden window)
