Technical Information
Malicious functions:
Creates and executes the following:
- '%APPDATA%\Microsoft Services\svchost.exe'
Modifies file system :
Creates the following files:
- %APPDATA%\jfstdtdd.mp3
- %APPDATA%\Microsoft Services\svchost.exe
- %APPDATA%\pqphoekj.mp3
Sets the 'hidden' attribute to the following files:
- %APPDATA%\Microsoft Services\svchost.exe
Network activity:
Connects to:
- 'bo###.ownz.su':80
- 'wp#d':80
TCP:
HTTP GET requests:
- wp#d/wpad.dat
HTTP POST requests:
- bo###.ownz.su/socks/exec.php?mo######
UDP:
- DNS ASK wp#d
- DNS ASK bo###.ownz.su
