Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'WX Real IP' = '<Full path to file>'
Malicious functions
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="<File name>" dir=in action=allow program="<Full path to file>" enable=yes
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="<File name>" dir=out action=allow program="<Full path to file>" enable=yes
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\inetcookies\deprecated.cookie
- <Current directory>\wxscope\est.adf
Network activity
Connects to
- 'wx##a.com':80
- 'ch####p.dyndns.org':8245
TCP
HTTP GET requests
- http://www.wx##a.com/RIP.txt
UDP
- DNS ASK wx##a.com
- DNS ASK ch####p.dyndns.org
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'StartNewUpdate'
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="<File name>" dir=in action=allow program="<Full path to file>" enable=yes' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="<File name>" dir=out action=allow program="<Full path to file>" enable=yes' (with hidden window)
