Technical Information
Malicious functions:
Creates and executes the following:
- <SYSTEM32>\33.exe (downloaded from the Internet)
- <SYSTEM32>\Beholder.exe (downloaded from the Internet)
- <SYSTEM32>\Messenger.exe (downloaded from the Internet)
- <SYSTEM32>\31.exe (downloaded from the Internet)
Executes the following:
- <SYSTEM32>\regsvr32.exe /s smss.dll
Modifies file system :
Creates the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\clonado[1].jjs
- <SYSTEM32>\33.exe
- <SYSTEM32>\Beholder.exe
- <SYSTEM32>\smss.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\smss[1].jjs
- <SYSTEM32>\Messenger.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\Messenger[1].jjs
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\MSDOS[1].jjs
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\win32[1].jjs
- <SYSTEM32>\31.exe
Network activity:
Connects to:
- 'si#######resma.sites.uol.com.br':80
- 'localhost':1035
TCP:
HTTP GET requests:
- si#######resma.sites.uol.com.br/mynoticia/clonado.jjs
- si#######resma.sites.uol.com.br/mynoticia/smss.jjs
- si#######resma.sites.uol.com.br/mynoticia/win32.jjs
- si#######resma.sites.uol.com.br/mynoticia/Messenger.jjs
- si#######resma.sites.uol.com.br/mynoticia/MSDOS.jjs
UDP:
- DNS ASK si#######resma.sites.uol.com.br
