Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\rundll32.exe' shell32.dll,Control_RunDLL "%TEMP%\iay.cpl",
Terminates or attempts to terminate
the following user processes:
- chrome.exe
- firefox.exe
- iexplore.exe
Modifies file system :
Creates the following files:
- %TEMP%\iay.cpl
Network activity:
Connects to:
- 'tu####mnavida.com':80
TCP:
HTTP POST requests:
- tu####mnavida.com/chato201/verifica.php
UDP:
- DNS ASK tu####mnavida.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
Modifies value of AutoConfigURL parameter
