Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\taskkill.exe' /f /im DNF.exe.manifest
Modifies file system:
Creates the following files:
- C:\swkss.ini
Substitutes the following executable files:
- <Full path to file>
Moves itself:
- from <Full path to file> to %TEMP%\1e039.tmp
Network activity:
Connects to:
- 'www.cm##wl.com':80
- 'localhost':1037
TCP:
HTTP GET requests:
- http://www.cm##wl.com/kss_api/api.php?a=#######################################################
UDP:
- DNS ASK www.cm##wl.com
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: 'TenSafe.exe_3'
- ClassName: '' WindowName: 'TenSafe.exe_2'
- ClassName: '' WindowName: 'TenSafe.exe_1'
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: 'TenSafe_3.exe'
- ClassName: '' WindowName: ''
- ClassName: '' WindowName: 'TenSafe_1.exe'
- ClassName: '' WindowName: 'TenSafe.exe'
- ClassName: '' WindowName: 'Tencentdl.exe'
- ClassName: '' WindowName: 'TXPlatform.exe'
- ClassName: '' WindowName: 'QQDL.exe'
- ClassName: '' WindowName: 'TenSafe_2.exe'
