Technical Information
Malicious functions:
Creates and executes the following:
- <LS_APPDATA>\conf (2).exe
- <LS_APPDATA>\microsoft net framework 3.5.exe
- <LS_APPDATA>\config.exe
- <LS_APPDATA>\14.exe
- <LS_APPDATA>\13.exe
- <LS_APPDATA>\12.exe
Terminates or attempts to terminate
the following user processes:
- ICQ.exe
Modifies file system :
Creates the following files:
- <LS_APPDATA>\microsoft net framework 3.5.exe
- <LS_APPDATA>\config.exe
- %TEMP%\2514.bat
- <SYSTEM32>\d3d8caps.dat
- %APPDATA%\CRNJEUFU - 875.txt
- %TEMP%\2535.bat
- <LS_APPDATA>\conf (2).exe
- <LS_APPDATA>\13.exe
- %TEMP%\2461.bat
- <LS_APPDATA>\14.exe
- %TEMP%\2503.bat
- <LS_APPDATA>\12.exe
- %TEMP%\2482.bat
Sets the 'hidden' attribute to the following files:
- %TEMP%\2514.bat
- %TEMP%\2535.bat
- %TEMP%\2503.bat
- %TEMP%\2461.bat
- %TEMP%\2482.bat
Network activity:
Connects to:
- 'ho#####netw.16mb.com':21
- 'wp#d':80
TCP:
HTTP GET requests:
- wp#d/wpad.dat
UDP:
- DNS ASK ho#####netw.16mb.com
- DNS ASK wp#d
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
