Technical Information
Malicious functions
Searches for windows to
detect analytical utilities:
- ClassName: 'Regmonclass', WindowName: ''
- ClassName: 'Filemonclass', WindowName: ''
Modifies file system
Creates the following files
- <Current directory>\update.exe
- <Current directory>\update.ini
- C:\gx.tmp
Deletes the following files
- C:\gx.tmp
Network activity
Connects to
- '46##3.cn':80
TCP
HTTP GET requests
- http://www.46##3.cn/yz.txt
- http://16#.#8.185.88/qytj.exe
UDP
- DNS ASK 46##3.cn
Miscellaneous
Searches for the following windows
- ClassName: '4823-00000029' WindowName: ''
- ClassName: '18467-41' WindowName: ''
Creates and executes the following
- '<Current directory>\update.exe'
