Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\svchost.exe' -k
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Searches for windows to
detect analytical utilities:
- ClassName: 'Filemonclass' WindowName: ''
Modifies file system :
Creates the following files:
- %TEMP%\24adb.tmp
- %TEMP%\25089.tmp
- %TEMP%\SE1.tmp
- %TEMP%\24200.tmp
Deletes the following files:
- %TEMP%\24adb.tmp
- %TEMP%\25089.tmp
- %TEMP%\SE1.tmp
- %TEMP%\24200.tmp
Network activity:
Connects to:
- '12#.#25.114.144':80
TCP:
HTTP GET requests:
- 12#.#25.114.144/???#############################################
UDP:
- DNS ASK hi.##idu.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '18467-41' WindowName: ''
