Technical Information
Malicious functions:
Creates and executes the following:
- 'C:\ccc.exe'
- 'C:\ccc.exe' (downloaded from the Internet)
Executes the following:
- '<SYSTEM32>\wscript.exe' "C:\9760.vbs"
Modifies file system :
Creates the following files:
- C:\9760.vbs
- %WINDIR%\WinAutoUpdate.com
- C:\ccc.exe
Deletes the following files:
- C:\9760.vbs
Deletes itself.
Network activity:
Connects to:
- 'ha##e41.com':80
- 'localhost':1037
TCP:
HTTP GET requests:
- ha##e41.com/ccc.exe
UDP:
- DNS ASK ha##e41.com
