Technical Information
Modifies file system :
Creates the following files:
- <Current directory>\SkinH_EL.dll
- <Current directory>\Anro.sys
Sets the 'hidden' attribute to the following files:
- <Current directory>\SkinH_EL.dll
Moves the following files:
- from <Current directory>\Anro.sys to <Current directory>\TTnn.sys
Network activity:
Connects to:
- 'tt##.yn23.com':80
TCP:
HTTP GET requests:
- tt##.yn23.com/data/16408/
UDP:
- DNS ASK tt##.yn23.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
