Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\attrib.exe' "<Full path to virus>" -h -r -s
- '<SYSTEM32>\dwm.exe' %##$%$%$.exe
Modifies file system :
Creates the following files:
- <Current directory>\q8imatqzodl60an.bat
- <SYSTEM32>\dwm.exe %##$%$%$.exe
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\dwm.exe %##$%$%$.exe
Deletes itself.
Network activity:
UDP:
- DNS ASK dn#.##ftncsi.com
- DNS ASK pd###.egloos.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
