Technical Information
Malicious functions:
Creates and executes the following:
- '%ALLUSERSPROFILE%\Application Data\804507.exe' (downloaded from the Internet)
Modifies file system:
Creates the following files:
- %ALLUSERSPROFILE%\Application Data\804507.exe
Network activity:
Connects to:
- 'www.in####nights.net':80
TCP:
HTTP GET requests:
- http://www.in####nights.net/menu/includes/mp3.exe
UDP:
- DNS ASK www.in####nights.net
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: 'project1.exe'
