Technical Information
Malicious functions:
Creates and executes the following:
- '<Current directory>\<Virus name>_.exe'
- '<Current directory>\<Virus name>_.exe' (downloaded from the Internet)
Executes the following:
- '<SYSTEM32>\cmd.exe' /c <Current directory>\$$336699.bat
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG' WindowName: '(null)'
Modifies file system :
Creates the following files:
- <Current directory>\$$336699.bat
- <Current directory>\<Virus name>_.exe
Deletes itself.
Network activity:
Connects to:
- 'sp###soft.com':80
TCP:
HTTP GET requests:
- sp###soft.com/store/SGUE_inst.exe
- sp###soft.com/store/updates/SGUE/upd.dat
UDP:
- DNS ASK sp###soft.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
