Technical Information
Malicious functions:
Creates and executes the following:
- '%TEMP%\freedocs.exe'
Modifies file system:
Creates the following files:
- %TEMP%\freedocs.exe
- %TEMP%\tempCD4B.tmp
Deletes itself.
Network activity:
Connects to:
- 'he##.or.ug':80
- 'he###we-art.com':80
- 'ch####p.dyndns.org':80
TCP:
HTTP GET requests:
- http://he##.or.ug/misc/monuk13.png
- http://he###we-art.com/monuk13.png
- http://ch####p.dyndns.org/
UDP:
- DNS ASK he##.or.ug
- DNS ASK he###we-art.com
- DNS ASK ch####p.dyndns.org
