Technical Information
Malicious functions:
Creates and executes the following:
- '%TEMP%\giod.exe'
- '%TEMP%\cimd.exe'
- '%TEMP%\bckd.exe'
- '%TEMP%\lofd.exe'
- '%TEMP%\giod.exe' (downloaded from the Internet)
- '%TEMP%\cimd.exe' (downloaded from the Internet)
- '%TEMP%\lofd.exe' (downloaded from the Internet)
- '%TEMP%\bckd.exe' (downloaded from the Internet)
Executes the following:
- '%WINDIR%\explorer.exe'
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
Modifies file system :
Creates the following files:
- %TEMP%\cimd.exe
- %TEMP%\giod.exe
- %TEMP%\lofd.exe
- %TEMP%\bckd.exe
Network activity:
Connects to:
- 'do#####ds.adaware.cc':80
- '82.##9.170.11':80
- 'cc.##-ware.cc':80
TCP:
HTTP GET requests:
- 82.##9.170.11/nb9.exe
- 82.##9.170.11/wincom.exe
- 82.##9.170.11/y.jpg
- 82.##9.170.11/win.exe
- cc.##-ware.cc/dia590/m.jpg
- 82.##9.170.11/w.php?e=#################
- do#####ds.adaware.cc/loader126.exe
UDP:
- DNS ASK do#####ds.adaware.cc
- DNS ASK cc.##-ware.cc
