Technical Information
Malicious functions:
Creates and executes the following:
- '%APPDATA%\Microsoft Services\WUDFHost.exe'
Modifies file system :
Creates the following files:
- %APPDATA%\chadjahg.png
- %APPDATA%\Microsoft Services\WUDFHost.exe
- %APPDATA%\kgampknm.png
Sets the 'hidden' attribute to the following files:
- %APPDATA%\Microsoft Services\WUDFHost.exe
Network activity:
Connects to:
- 'li##.#omenumbers.ru':80
- 'wp#d':80
TCP:
HTTP GET requests:
- wp#d/wpad.dat
HTTP POST requests:
- li##.#omenumbers.ru/still000298/exec.php?mo######
UDP:
- DNS ASK wp#d
- DNS ASK li##.#omenumbers.ru
