Technical Information
Malicious functions:
Creates and executes the following:
- <Full path to virus>.tmp
Executes the following:
- <SYSTEM32>\ntvdm.exe -f -i1
Modifies file system :
Creates the following files:
- %WINDIR%\Temp\scs1.tmp
- %WINDIR%\Temp\scs2.tmp
- <Current directory>\0O5FK1XLJP6.exe
- <Full path to virus>.tmp
- <Current directory>\O2J1208VXC9X.tmp
Deletes the following files:
- %WINDIR%\Temp\scs1.tmp
- %WINDIR%\Temp\scs2.tmp
- <Full path to virus>.tmp
- <Current directory>\O2J1208VXC9X.tmp
Network activity:
Connects to:
- 'www.lm##123.com':80
TCP:
HTTP GET requests:
- www.lm##123.com/kills.txt
UDP:
- DNS ASK www.lm##123.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-b44.b48.390001'
- ClassName: 'Shell_TrayWnd' WindowName: ''
