Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = 'userinit.exe,netste.exe'
Malicious functions
Injects code into
the following user processes:
- seete.exe
- netste.exe
Modifies file system
Creates the following files
- %WINDIR%\syswow64\msaro.exe
- %TEMP%\msaro.exe
- %WINDIR%\syswow64\wmsfeu.dll
- %WINDIR%\syswow64\smfelf.dll
- %TEMP%\seete.exe
- %WINDIR%\netste.exe
- %WINDIR%\netsci.dll
Deletes the following files
- %WINDIR%\syswow64\msaro.exe
- %TEMP%\seete.exe
Deletes itself.
Network activity
Connects to
- '34.##9.100.209':443
TCP
Other
- '34.##9.100.209':443
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\msaro.exe'
- '%TEMP%\msaro.exe'
- '%TEMP%\seete.exe'
- '%WINDIR%\netste.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c del <Full path to file> > nul
- '%WINDIR%\syswow64\cmd.exe' /c del %WINDIR%\SysWOW64\msaro.exe > nul
- '%ProgramFiles(x86)%\opera\launcher.exe' http://about:blank
- '%WINDIR%\syswow64\cmd.exe' /c del %TEMP%\seete.exe > nul
- '%WINDIR%\syswow64\cmd.exe' /c del <Full path to file> > nul' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del %WINDIR%\SysWOW64\msaro.exe > nul' (with hidden window)
- '%ProgramFiles(x86)%\opera\launcher.exe' http://about:blank' (with hidden window)
- '%TEMP%\seete.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del %TEMP%\seete.exe > nul' (with hidden window)
