Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\netsh.exe
- %HOMEPATH%\Start Menu\Programs\Startup\update.exe
Malicious functions:
Creates and executes the following:
- '%HOMEPATH%\Start Menu\Programs\Startup\update.exe'
Modifies file system :
Creates the following files:
- %APPDATA%\jil_fm.url
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\jilfm.hol[1]
- %TEMP%\aut3.tmp
- %TEMP%\aut1.tmp
- %TEMP%\aut2.tmp
Deletes the following files:
- %TEMP%\aut3.tmp
- %TEMP%\aut2.tmp
- %TEMP%\aut1.tmp
Network activity:
Connects to:
- 'li####dou.no-ip.biz':24231
- 'ji###.hol.es':80
- 'localhost':1037
TCP:
HTTP GET requests:
- ji###.hol.es/
UDP:
- DNS ASK li####dou.no-ip.biz
- DNS ASK ji###.hol.es
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: '' WindowName: '(null)'
