Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

• [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'DriverAudio' = '"%APPDATA%\driveraudio.exe"'

Creates the following files on removable media:

• <Drive name for removable media>:\autorun.inf
• <Drive name for removable media>:\RECYCLER\S-11-7-07-1107-042981-1107\autorun.exe
• <Drive name for removable media>:\RECYCLER\desktop.ini

Malicious functions:

Injects code into the following system processes:

• %WINDIR%\Explorer.EXE

Modifies file system:

Creates the following files:

• %APPDATA%\driveraudio.exe

Sets the 'hidden' attribute to the following files:

• <Drive name for removable media>:\RECYCLER\desktop.ini
• <Drive name for removable media>:\RECYCLER\S-11-7-07-1107-042981-1107\autorun.exe
• <Drive name for removable media>:\autorun.inf

Network activity:

Connects to:

• DNS ASK dn#.##oenix-cc.net

UDP:

• DNS ASK dn#.##oenix-cc.net

Miscellaneous:

Searches for the following windows:

• ClassName: 'Indicator' WindowName: ''