Technical Information
Malicious functions:
Creates and executes the following:
- <LS_APPDATA>\config.exe
- <LS_APPDATA>\microsoft net framework 3.5.exe
- <LS_APPDATA>\conf (2).exe
Terminates or attempts to terminate
the following user processes:
- ICQ.exe
Modifies file system :
Creates the following files:
- %TEMP%\2862.bat
- %APPDATA%\CRNJEUFU - 432.txt
- <SYSTEM32>\d3d8caps.dat
- <LS_APPDATA>\microsoft net framework 3.5.exe
- <LS_APPDATA>\conf (2).exe
- %TEMP%\2851.bat
- <LS_APPDATA>\config.exe
Sets the 'hidden' attribute to the following files:
- %TEMP%\2862.bat
- %TEMP%\2851.bat
Network activity:
Connects to:
- 'ho#####netw.16mb.com':21
- 'wp#d':80
TCP:
HTTP GET requests:
- wp#d/wpad.dat
UDP:
- DNS ASK ho#####netw.16mb.com
- DNS ASK wp#d
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
