Technical Information
Malicious functions:
Creates and executes the following:
- '%APPDATA%\csrss.exe' <Full path to virus>
Executes the following:
- '<SYSTEM32>\ping.exe' 127.0.0.1 -n 5
Modifies file system :
Creates the following files:
- %TEMP%\tmp3.tmp
- %TEMP%\uio4.tmp
- %TEMP%\tmp5.tmp
- %TEMP%\nsh2.tmp\System.dll
- %APPDATA%\csrss.exe
- %PROGRAM_FILES%\MirDisk\ver.ini
- %WINDIR%\Downloaded Program Files\MirDiskCtrl.dll
Deletes the following files:
- %TEMP%\tmp5.tmp
- %APPDATA%\csrss.exe
- %TEMP%\uio4.tmp
- %TEMP%\nsh2.tmp\System.dll
- %TEMP%\tmp3.tmp
Deletes itself.
Network activity:
Connects to:
- '20#.#24.194.233':9090
