Technical Information
Malicious functions:
Creates and executes the following:
- '<SYSTEM32>\ambcj65jur.exe'
- '<SYSTEM32>\ambcjj.scr'
- '<SYSTEM32>\ambcj65plu.exe'
- '<SYSTEM32>\ambcjj.scr' (downloaded from the Internet)
- '<SYSTEM32>\ambcj65plu.exe' (downloaded from the Internet)
- '<SYSTEM32>\ambcj65jur.exe' (downloaded from the Internet)
Modifies file system :
Creates the following files:
- <SYSTEM32>\ambcj65jur.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ambcjj[1].jpg
- <SYSTEM32>\ambcjj.scr
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ambcj65plu[1].jpg
- <SYSTEM32>\ambcj65plu.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\ambcj65jur[1].jpg
Network activity:
Connects to:
- 'ar####e.tempsite.ws':80
- 'localhost':1035
TCP:
HTTP GET requests:
- ar####e.tempsite.ws/ambcjj.jpg
- ar####e.tempsite.ws/ambcj65jur.jpg
- ar####e.tempsite.ws/ambcj65plu.jpg
UDP:
- DNS ASK ar####e.tempsite.ws
