Technical Information
Malicious functions:
Creates and executes the following:
- '%TEMP%\is-5C3JF.tmp\setupb.tmp' /SL5="$60036,103424,0,<Current directory>\setupb.exe"
- '<Current directory>\setupb.exe'
Modifies file system :
Creates the following files:
- %TEMP%\nse2.tmp\blowfish.dll
- %TEMP%\lnk.txt
- %TEMP%\is-HCT6L.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-5C3JF.tmp\setupb.tmp
- %WINDIR%\bfcs2.dll
- <Current directory>\setupb.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\lnk6[1].txt
- %TEMP%\nse2.tmp\inetc.dll
Sets the 'hidden' attribute to the following files:
- %WINDIR%\bfcs2.dll
- <Current directory>\setupb.exe
Network activity:
Connects to:
- 'xt##rs.info':80
TCP:
HTTP GET requests:
- xt##rs.info/lnks/lnk6.txt
UDP:
- DNS ASK xt##rs.info
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
