Technical Information
Malicious functions:
Creates and executes the following:
- '%HOMEPATH%\bJq89C.exe'
- '%HOMEPATH%\yFx10G\smss.exe'
- '%HOMEPATH%\bJq89C.exe' (downloaded from the Internet)
Modifies file system :
Creates the following files:
- %TEMP%\gUb56Z.LO2
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\181891799.RuneTools[1].exe
- %HOMEPATH%\bJq89C.exe
- %HOMEPATH%\yFx10G\smss.exe
- %HOMEPATH%\yFx10G\eRn.ite
- %TEMP%\aut1.tmp
Sets the 'hidden' attribute to the following files:
- %HOMEPATH%\bJq89C.exe
- %TEMP%\gUb56Z.LO2
Deletes the following files:
- %TEMP%\aut1.tmp
Network activity:
Connects to:
- 'www.di###txex.com':80
TCP:
HTTP GET requests:
- www.di###txex.com/uploads/181891799.RuneTools.exe
UDP:
- DNS ASK www.di###txex.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
