Technical Information
Malicious functions:
Creates and executes the following:
- '<Current directory>\l2updater.new.exe' /update "<Current directory>\l2updater.exe"
- '<Current directory>\l2updater.exe'
- '<Current directory>\l2updater.new.exe' (downloaded from the Internet)
Executes the following:
- '<SYSTEM32>\wbem\wmiadap.exe' /R /T
- '<SYSTEM32>\ping.exe' -n 3 localhost
- '<SYSTEM32>\cmd.exe' /c ""<Current directory>\init.bat" "
Modifies file system :
Creates the following files:
- %HOMEPATH%\Desktop\Play L2H5.lnk
- <Current directory>\l2updater.new.exe
- <Current directory>\l2updater1.exe
- <Current directory>\init.bat
Deletes the following files:
- <SYSTEM32>\PerfStringBackup.TMP
- <SYSTEM32>\wbem\Performance\WmiApRpl.ini
Moves the following files:
- from <Current directory>\l2updater1.exe to <Current directory>\l2updater.exe
Network activity:
Connects to:
- 'www.l2##.com':80
TCP:
HTTP GET requests:
- www.l2##.com/lupload/l2updater.exe
- www.l2##.com/lupload/options.xml
UDP:
- DNS ASK www.l2##.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
