Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\net.exe' stop sharedaccess
Modifies file system:
Creates the following files:
- <Current directory>\ftp.txt
- <Current directory>\123.txt
- %TEMP%\~1.bat
- %WINDIR%\pand.txt
Sets the 'hidden' attribute to the following files:
- %TEMP%\~1.bat
Deletes the following files:
- <Current directory>\ftp.txt
Network activity:
Connects to:
- 'go#.gl':80
- 'ar###.##stantfreesite.com':21
- 'localhost':1038
- 'localhost':1040
TCP:
HTTP GET requests:
- http://go#.gl/wGxnF
UDP:
- DNS ASK ar###.##stantfreesite.com
- DNS ASK go#.gl
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
Executes the following:
- '<SYSTEM32>\ftp.exe' -s:ftp.txt
- '<SYSTEM32>\cmd.exe' /c type "<SYSTEM32>\vvtn.txt"
- '%ProgramFiles%\Internet Explorer\IEXPLORE.EXE' -nohome
- '<SYSTEM32>\cmd.exe' /c %TEMP%\~1.bat <Full path to file>
- '<SYSTEM32>\net1.exe' stop sharedaccess
