Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\setup.exe
- <Drive name for removable media>:\autorun.inf
- <Drive name for removable media>:\installer.exe
Malicious functions
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system
Creates the following files
- D:\setup.exe
- D:\autorun.inf
- D:\usbdriver.exe
Network activity
TCP
HTTP GET requests
- http://x.##2.us/x.cer
UDP
- DNS ASK en#######0oq.x.pipedream.net
- DNS ASK IF###.bitbucket.com
- DNS ASK R.###bucket.com
- DNS ASK wC#####Jb.bitbucket.com
- DNS ASK s.###bucket.com
- DNS ASK UY######qKZH.bitbucket.com
- DNS ASK c.###bucket.com
- DNS ASK Ka#.##tbucket.com
- DNS ASK cb####.bitbucket.com
- DNS ASK oT.#######RubHAcjvxnQps.readme.io
- DNS ASK Tr#######.##eSOEkKjyxIyOYHDziD.readme.io
- DNS ASK op######gI.bitbucket.com
- DNS ASK le#####N.bitbucket.com
- DNS ASK jm##c.com
- DNS ASK HW######om.bitbucket.com
- DNS ASK jH###.bitbucket.com
- DNS ASK GT#####k.bitbucket.com
- DNS ASK Fl#####.bitbucket.com
- DNS ASK jW###.bitbucket.com
- DNS ASK zi#####Xf.bitbucket.com
- DNS ASK iK######yv.bitbucket.com
- DNS ASK ZW.###bucket.com
- DNS ASK VZ######MnvIt.bitbucket.com
- DNS ASK ba##s.edu
- DNS ASK Jc###.bitbucket.com
- DNS ASK no###llsnow.com
- DNS ASK Mg#####a.bitbucket.com
- DNS ASK ra#.####ubusercontent.com
- DNS ASK me#a.nz
- DNS ASK ap###rror.com
- DNS ASK aZ####.bitbucket.com
- DNS ASK ka###wer.com
- DNS ASK AU######Sj.bitbucket.com
- DNS ASK bi###cket.org
- DNS ASK l.###bucket.com
- DNS ASK TB######XS.bitbucket.com
- DNS ASK co####ad.github.com
- DNS ASK qO#.##tbucket.com
- DNS ASK Ry#####x.bitbucket.com
- DNS ASK CB#####.bitbucket.com
- DNS ASK jH##.#itbucket.com
- DNS ASK x.###bucket.com
- DNS ASK jm####p.mxp4037.com
- DNS ASK zE##.#####HmUiJfEZwfuLrpL.readme.io
- DNS ASK dr##box.com
- DNS ASK jW###.#####oQGGYvbKRNcAgTJ.readme.io
- DNS ASK uX######HYNN.bitbucket.com
- DNS ASK Kx###.bitbucket.com
- DNS ASK id####rcial.com.br
- DNS ASK Ya##.#itbucket.com
- DNS ASK x.##2.us
