Technical Information
Modifies file system :
Creates the following files:
- <Full path to virus>{B953052E-2D7E-435f-BBE4-F44A02DFF12B}
- <Current directory>\RCX5.tmp
- <Full path to virus>
- %TEMP%\1.tmp
- %TEMP%\2.tmp
- %TEMP%\3.tmp
Deletes the following files:
- <Full path to virus>{B953052E-2D7E-435f-BBE4-F44A02DFF12B}
- <DRIVERS>\etc\hosts
- %TEMP%\3.tmp
- %TEMP%\1.tmp
- %TEMP%\2.tmp
Moves the following files:
- from <Current directory>\RCX5.tmp to <Full path to virus>{B953052E-2D7E-435f-BBE4-F44A02DFF12B}
Substitutes the HOSTS file.
Moves itself:
- from <Full path to virus> to %TEMP%\_@4.tmp
Network activity:
Connects to:
- 'cf#####i.blog.163.com':80
TCP:
HTTP GET requests:
- cf#####i.blog.163.com/blog/static/217955126201481611851233/
UDP:
- DNS ASK cf#####i.blog.163.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
