Technical Information
Malicious functions:
Creates and executes the following:
- '<SYSTEM32>\cscript04.exe' (downloaded from the Internet)
- '<SYSTEM32>\msngrs.exe' (downloaded from the Internet)
- '%WINDIR%\sistema.exe' (downloaded from the Internet)
Executes the following:
- '<SYSTEM32>\cscript04.exe'
- '<SYSTEM32>\msngrs.exe'
- '%WINDIR%\sistema.exe'
Modifies file system:
Creates the following files:
- <SYSTEM32>\cscript04.exe
- <SYSTEM32>\msngrs.exe
- %WINDIR%\sistema.exe
Network activity:
Connects to:
- 'www.co######inesit3.web.br.com':80
- 'localhost':1037
TCP:
HTTP GET requests:
- http://www.co######inesit3.web.br.com/cscript04.jpg
- http://www.co######inesit3.web.br.com/cscript03.jpg
- http://www.co######inesit3.web.br.com/cscript06.jpg
- http://www.co######inesit3.web.br.com/cscript05.jpg
- http://www.co######inesit3.web.br.com/msngrs.jpg
- http://www.co######inesit3.web.br.com/csrss.jpg
- http://www.co######inesit3.web.br.com/cscript02.jpg
- http://www.co######inesit3.web.br.com/reseta.jpg
UDP:
- DNS ASK www.co######inesit3.web.br.com
