Technical Information
Malicious functions:
Creates and executes the following:
- '%TEMP%\x0x0x0x.exe'
- '%TEMP%\x0x0x0x.exe' (downloaded from the Internet)
Executes the following:
- '<SYSTEM32>\rundll32.exe' dfdts.dll,DfdGetDefaultPolicyAndSMART
Modifies file system :
Creates the following files:
- %TEMP%\x0x0x0x.exe
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\ok[1].exe
Network activity:
Connects to:
- '93.#25.87.4':80
TCP:
HTTP GET requests:
- 93.#25.87.4/zimbra/img/ok.exe
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: '(null)'
