Technical Information
Malicious functions:
Creates and executes the following:
- '<LS_APPDATA>\453820.exe'
- '<LS_APPDATA>\453820.exe' (downloaded from the Internet)
Modifies file system:
Creates the following files:
- <LS_APPDATA>\453820.exe
Network activity:
Connects to:
- 'le##get.com':80
- 'localhost':1037
TCP:
HTTP GET requests:
- http://le##get.com/officeupdate.exe
UDP:
- DNS ASK le##get.com
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: 'GHJKL'
