Technical Information
Malicious functions:
Creates and executes the following:
- '%TEMP%\networking_service.exe' (downloaded from the Internet)
Executes the following:
- '%TEMP%\networking_service.exe'
- '%APPDATA%\codec.exe'
- '%APPDATA%\setup.exe'
Modifies file system:
Creates the following files:
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\Load[1].exe
- %TEMP%\networking_service.exe
- %APPDATA%\setup.exe
- %APPDATA%\codec.exe
Network activity:
Connects to:
- 'ti###.ugu.pl':80
TCP:
HTTP GET requests:
- http://ti###.ugu.pl/tiskr/Load.exe
UDP:
- DNS ASK ti###.ugu.pl
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
