Technical Information
Malicious functions:
Creates and executes the following:
- %APPDATA%\wizard.exe (downloaded from the Internet)
- %APPDATA%\eapgen.exe (downloaded from the Internet) /nogui %APPDATA%\eapgen.txt
- %APPDATA%\wiatwa.exe (downloaded from the Internet)
- %APPDATA%\mschapv.exe (downloaded from the Internet)
Modifies file system :
Creates the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\userenv[1].jpg
- %APPDATA%\wizard.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\userenv[1].gif
- %APPDATA%\eapgen.txt
- %APPDATA%\eapgen.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\ublastcln[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\psqldb[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\dbullet[1].gif
- %APPDATA%\mschapv.exe
- %APPDATA%\wiatwa.exe
Network activity:
Connects to:
- 'lu#####rmenmodas.cz.cc':80
TCP:
HTTP GET requests:
- lu#####rmenmodas.cz.cc/chars/userenv.jpg
- lu#####rmenmodas.cz.cc/chars/userenv.gif
- lu#####rmenmodas.cz.cc/intl/dbullet.gif
- lu#####rmenmodas.cz.cc/intl/psqldb.gif
- lu#####rmenmodas.cz.cc/intl/ublastcln.gif
UDP:
- DNS ASK lu#####rmenmodas.cz.cc
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
