Technical Information
To ensure autorun and distribution:
Substitutes the following executable system files:
- <SYSTEM32>\dllcache\iexplore.exe with <SYSTEM32>\dllcache\iexplore.exe.new
Malicious functions:
Executes the following:
- <SYSTEM32>\taskkill.exe /im iexplore.exe /f
- <SYSTEM32>\taskkill.exe /im chrome.exe /f
- <SYSTEM32>\taskkill.exe /im browser.exe /f
- <SYSTEM32>\taskkill.exe /im firefox.exe /f
Terminates or attempts to terminate
the following user processes:
- chrome.exe
- firefox.exe
- iexplore.exe
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\iinhbaeevbtkvhbbrnkfhrwuvxeqogrdtmuekmtloanryeemlaisfhyeiblczfqfbgraogudkjexrqpr.zip
Moves the following files:
- from <SYSTEM32>\dllcache\iexplore.exe.new to <SYSTEM32>\dllcache\iexplore.exe
- from %PROGRAM_FILES%\Internet Explorer\iexplore.exe.new to %PROGRAM_FILES%\Internet Explorer\iexplore.exe
Modifies the HOSTS file.
Network activity:
Connects to:
- 'si###ati.com':80
TCP:
HTTP GET requests:
- si###ati.com/ext.zip
- si###ati.com/gorev.php?ok##
- si###ati.com/hosts.txt
- si###ati.com/id.txt?0
UDP:
- DNS ASK si###ati.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_WINHELP' WindowName: ''
- ClassName: '' WindowName: ''
