Poison Ivy
"thj@h" means code in receive bytes
"cks=u" means socks protocol
"6I*h<8" means portion of Camellia sbox
Takahiro Haruyama
2012-08-10T12:26:43
IEXPLORE.EXE
-nohome
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Active Setup\Installed Components\
EXECUTE_READWRITE PrivateMemory MemCommit SecNoChange CopyOnWrite
EXECUTE_READWRITE PrivateMemory MemCommit MultipleSecured
Explorer.EXE
EXECUTE_READWRITE PrivateMemory MemCommit SecNoChange CopyOnWrite
EXECUTE_READWRITE PrivateMemory MemCommit MultipleSecured
CONNECT %s:%i HTTP/1.0
?503
thj@h
cks=u
6I*h<8