Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\svchost.exe'
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system:
Creates the following files:
- %TEMP%\wmsotlx\CuDorxw.dll
- <SYSTEM32>\C30A9.dat
- <SYSTEM32>\C30A9.txt
- <SYSTEM32>\ЕдЦГ.txt
- <Auxiliary element>
- <SYSTEM32>\CDCLOG.txt
Deletes the following files:
- <SYSTEM32>\C30A9.dat
Network activity:
Connects to:
- 'localhost':1040
- '58#d.cn':80
- 'www.58#d.cn':80
TCP:
HTTP GET requests:
- http://58#d.cn/api/get?id######
- http://www.58#d.cn/api/get?id######
UDP:
- DNS ASK www.go##0.com
- DNS ASK 58#d.cn
- DNS ASK www.58#d.cn
Miscellaneous:
Searches for the following windows:
- ClassName: 'SysListView32' WindowName: 'FolderView'
- ClassName: 'SHELLDLL_DefView' WindowName: ''
- ClassName: 'Progman' WindowName: 'Program Manager'
