Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\regsvr32.exe' /s <SYSTEM32>\NetLive.dll
Modifies file system :
Creates the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\2009[1].html
- <SYSTEM32>\NetLive.dll
- <Auxiliary element>
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\NetLive.dll
Network activity:
Connects to:
- 'www.ha##y.com':80
- 'localhost':1035
TCP:
HTTP GET requests:
- www.ha##y.com/2009.html
UDP:
- DNS ASK www.ha##y.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: '(null)' WindowName: 'GINA Logon'
- ClassName: 'MS_WINHELP' WindowName: '(null)'
