Technical Information
Malicious functions:
Creates and executes the following:
- 'C:\0e3dbdff1e3e2d3a876a688c266a85\update\update.exe'
Executes the following:
- '<SYSTEM32>\wbem\wmiadap.exe' /R /T
Modifies file system :
Creates the following files:
- C:\0e3dbdff1e3e2d3a876a688c266a85\update\eula.txt
- C:\0e3dbdff1e3e2d3a876a688c266a85\update\update.inf
- C:\0e3dbdff1e3e2d3a876a688c266a85\update\update.exe
- %WINDIR%\KB818801.log
- C:\0e3dbdff1e3e2d3a876a688c266a85\$shtdwn$.req
- C:\0e3dbdff1e3e2d3a876a688c266a85\update\update.ver
- C:\0e3dbdff1e3e2d3a876a688c266a85\update\spcustom.dll
- C:\0e3dbdff1e3e2d3a876a688c266a85\spuninst.exe
- C:\0e3dbdff1e3e2d3a876a688c266a85\spmsg.dll
- C:\0e3dbdff1e3e2d3a876a688c266a85\empty.cat
- C:\0e3dbdff1e3e2d3a876a688c266a85\update\kb818801.cat
- C:\0e3dbdff1e3e2d3a876a688c266a85\sysaudio.sys
- C:\0e3dbdff1e3e2d3a876a688c266a85\portcls.sys
Deletes the following files:
- <SYSTEM32>\PerfStringBackup.TMP
- <SYSTEM32>\wbem\Performance\WmiApRpl.ini
Network activity:
Connects to:
- 'www.ky##go.com':808
- 'localhost':1035
UDP:
- DNS ASK www.ky##go.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
