Technical Information
Malicious functions:
Creates and executes the following:
- '%TEMP%\2.tmp.exe' /silent
- '%TEMP%\2.tmp.exe' (downloaded from the Internet)
Modifies file system :
Creates the following files:
- %TEMP%\2.tmp.exe
- %TEMP%\1.tmp.exe
Network activity:
Connects to:
- 'os##oft.com':80
- 'ne#.##o.opera.com':80
- 'localhost':1039
- 'ip##pi.com':80
- 'www.go#####analytics.com':80
TCP:
HTTP GET requests:
- http://os##oft.com/download/bundles4.xml?c8##################################
- http://ne#.##o.opera.com/opera/stable?ut#######################################################
- http://ip##pi.com/xml
- http://os##oft.com/download2/Bundle.exe
HTTP POST requests:
- http://www.go#####analytics.com/collect
UDP:
- DNS ASK os##oft.com
- DNS ASK ne#.##o.opera.com
- DNS ASK ip##pi.com
- DNS ASK www.go#####analytics.com
