Technical Information
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Creates and executes the following:
- "%TEMP%\messenger.exe" (downloaded from the Internet)
Modifies file system :
Creates the following files:
- %TEMP%\messenger.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\anti[1].ini
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\42890[1]
Network activity:
Connects to:
- 'dl.##opbox.com':80
- 'www.ad#####tradores.com.br':80
- 'localhost':1037
TCP:
HTTP GET requests:
- dl.##opbox.com/u/37979815/anti.ini
- www.ad#####tradores.com.br/informe-se/carreira-e-rh/o-novo-momento-para-os-profissionais-do-setor-de-cobranca-e-credito/42890/
UDP:
- DNS ASK dl.##opbox.com
- DNS ASK www.ad#####tradores.com.br
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
