Technical Information
Malicious functions:
Creates and executes the following:
- '<Full path to file>' (downloaded from the Internet)
Network activity:
Connects to:
- 'localhost':80
- 'ge#.###nnattygulden.bid':80
TCP:
HTTP GET requests:
- http://localhost/
- http://ge#.###nnattygulden.bid/?af#############################################################
UDP:
- DNS ASK ge#.###nnattygulden.bid
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_WINHELP' WindowName: ''
