Technical Information
Malicious functions:
Creates and executes the following:
- %TEMP%\z_12521.exe (downloaded from the Internet)
- %TEMP%\bb1ccs_12521.exe (downloaded from the Internet)
Executes the following:
- %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://%6########74%68%65%73%78%63%2Einfo/index.php?ff####################################################################################################################################################################
- %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://%6########74%68%65%73%78%63%2Einfo/index.php?ff##############################################################################################################################################################
Modifies file system :
Creates the following files:
- %TEMP%\bb1ccs_12521.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ok[1].php
- %TEMP%\z_12521.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\down[1].php
- %TEMP%\nsp2.tmp\Math.dll
- %TEMP%\nsp2.tmp\System.dll
- %TEMP%\nsp2.tmp\time.dll
- %TEMP%\nsp2.tmp\InetLoad.dll
Network activity:
Connects to:
- '17#.#92.187.156':1156
- 'go.##esxc.info':80
- 'zx##.#ronsy.info':777
TCP:
HTTP GET requests:
- go.##esxc.info/down.php?i=#
- go.##esxc.info/ok.php?i=#####
UDP:
- DNS ASK go.##esxc.info
- DNS ASK zx##.#ronsy.info
- '<Private IP address>':1036
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
