Technical Information
Malicious functions:
Creates and executes the following:
- '%WINDIR%\myd_d.exe'
- '%WINDIR%\myc_c.exe'
- '%WINDIR%\pmyb_b.exe'
- '%WINDIR%\imya.exe'
- '%WINDIR%\myd_d.exe' (downloaded from the Internet)
- '%WINDIR%\myc_c.exe' (downloaded from the Internet)
- '%WINDIR%\imya.exe' (downloaded from the Internet)
- '%WINDIR%\pmyb_b.exe' (downloaded from the Internet)
Modifies file system :
Creates the following files:
- %WINDIR%\myc_c.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\my3[1].rar
- %WINDIR%\myd_d.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\my4[1].rar
- %WINDIR%\pmyb_b.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\my[1].rar
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\my2[1].rar
- %WINDIR%\imya.exe
Deletes the following files:
- %TEMP%\~DFDC54.tmp
Network activity:
Connects to:
- 'www.tu##ng.net':80
- 'localhost':1036
TCP:
HTTP GET requests:
- www.tu##ng.net/ad/my_70169/my3.rar
- www.tu##ng.net/ad/my_70169/my4.rar
- www.tu##ng.net/ad/my_70169/my.rar
- www.tu##ng.net/ad/my_70169/my2.rar
UDP:
- DNS ASK www.tu##ng.net
