Technical Information
To ensure autorun and distribution:
Substitutes the following executable system files:
- <SYSTEM32>\mswsock.dll with <SYSTEM32>\mswsock.dll
Infects the following executable files:
- <SYSTEM32>\mswsock.dll
Modifies file system :
Creates the following files:
- <SYSTEM32>\pe.dll
- <SYSTEM32>\rpcso4.dll
Moves the following system files:
- from <SYSTEM32>\mswsock.dll to <SYSTEM32>\~NET1F.tmp
Moves itself:
- from <Full path to virus> to %TEMP%\Tm147437.dat
Network activity:
Connects to:
- '12#.#33.252.147':80
- '20#.#6.18.94':80
TCP:
HTTP GET requests:
- 12#.#33.252.147/news/zzejbpmz.asp?id################
- 12#.#33.252.147/news/gipobmya.asp?id################
- 12#.#33.252.147/news/dnkbpulm.asp?id####################
- 20#.#6.18.94/news/tpldtshg.asp?id################
- 12#.#33.252.147/news/zchweusb.asp?id################
