Technical Information
Malicious functions:
Creates and executes the following:
- '%TEMP%\RarSFX0\starts.exe'
Modifies file system :
Creates the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\detskie_pesni_na_anglijskom_yazyke_-_www.dreamenglish.com-halloweenforkids[1].mp3
- %ALLUSERSPROFILE%\Desktop\Download detskie_pesni_...lnk
- %TEMP%\RarSFX0\starts.exe
Network activity:
Connects to:
- '2x##tm.ru':80
- 'localhost':1046
- 'localhost':1041
- 'lu######tie64.steauahub.ro':80
- '8k######d4j9kvt.kuvott.ru':80
TCP:
HTTP POST requests:
- 8k######d4j9kvt.kuvott.ru/api/index
- lu######tie64.steauahub.ro/api/index
UDP:
- DNS ASK 2x##tm.ru
- DNS ASK 8k######d4j9kvt.kuvott.ru
- DNS ASK lu######tie64.steauahub.ro
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'IEFrame' WindowName: '(null)'
- ClassName: 'ReBarWindow32' WindowName: ''
- ClassName: 'WMPlayerApp' WindowName: '(null)'
- ClassName: 'WMP9DeskBand' WindowName: 'WMP9DeskBand'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: '' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
