When the worm is executed, it creates the following files:
- %Temp%\wtmps.exe
- %UserProfile%\Application Data\Microsoft\Defender\launch.exe
- %UserProfile%\Application Data\Microsoft\Caches\Files\usd.dll
- %UserProfile%\Application Data\Microsoft\Repairs\sha.dll
- %UserProfile%\Application Data\Microsoft\Shared\Modules\fil.dll
- %UserProfile%\Application Data\Microsoft\Common\Shared\dis.dll
- %UserProfile%\Application Data\Microsoft\Windows\Addins\att.dll
- %UserProfile%\Application Data\Microsoft\Identities\[USER NAME]\arc.dll
The worm creates the following registry entry so that it runs every time Windows starts:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
"Windows Defender Extension" = "%UserProfile%\Application Data\Microsoft\Defender\launch.exe"
It then steals the following information from the compromised computer:
- Computer name
- User name
- Operating system language
- MAC address
- IP address
It attempts to connect to following domains using DNS protocol:
- a.gwas.perl.sh
- a-gwas-01.slyip.net
- a-gwas-01.dyndns.org
It then receives commands from the remote attacker to perform the following actions:
- List running processes
- Take screenshots
- Download files
- Send files to the attacker
- List the directory
- Collect information
- Run the command prompt
The worm attempts to spread by copying itself to removable drives and shared folders.
Symantec Security Response encourages all users and administrators to adhere to the following basic security "best practices":
