Technical Information
Malicious functions:
Creates and executes the following:
- '<Current directory>\Cities In Motion.exe'
Executes the following:
- '<SYSTEM32>\wermgr.exe' -queuereporting
Modifies file system :
Creates the following files:
- %TEMP%\dll.exe
- %TEMP%\nseC217.tmp\NSISdl.dll
- <Current directory>\Cities In Motion.exe
Sets the 'hidden' attribute to the following files:
- %TEMP%\dll.exe
- <Current directory>\Cities In Motion.exe
Network activity:
Connects to:
- 'pk.##9991.com':80
TCP:
HTTP GET requests:
- pk.##9991.com/dll.exe
UDP:
- DNS ASK pk.##9991.com
