Technical Information
Malicious functions:
Creates and executes the following:
- 'C:\nnvip6_01104.exe' (downloaded from the Internet)
Executes the following:
- 'C:\nnvip6_01104.exe'
Modifies file system:
Creates the following files:
- C:\nnvip6_01104.exe
Network activity:
Connects to:
- 'do#####d.soft798.com':80
TCP:
HTTP GET requests:
- http://do#####d.soft798.com/setup/nnvip6_01104.exe
UDP:
- DNS ASK do#####d.soft798.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
