Technical Information
Malicious functions:
Creates and executes the following:
- '' (downloaded from the Internet)
Modifies file system:
Creates the following files:
- %TEMP%\is-ESSOE.tmp\itdownload.dll
- %TEMP%\is-ESSOE.tmp\temp.exe
- %TEMP%\is-ESSOE.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-P24QJ.tmp\<File name>.tmp
- %TEMP%\is-ESSOE.tmp\_isetup\_RegDLL.tmp
Deletes the following files:
- %TEMP%\is-ESSOE.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-P24QJ.tmp\<File name>.tmp
- %TEMP%\is-ESSOE.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-ESSOE.tmp\itdownload.dll
- %TEMP%\is-ESSOE.tmp\temp.exe
Network activity:
Connects to:
- 'sn####streams.com':80
TCP:
HTTP GET requests:
- http://www.sn####streams.com/soft/dist/FreeMetacafeDownloader_3.0.0.exe via sn####streams.com
UDP:
- DNS ASK www.sn####streams.com
Miscellaneous:
Creates and executes the following:
- '%TEMP%\is-ESSOE.tmp\temp.exe'
- '%TEMP%\is-P24QJ.tmp\<File name>.tmp' /SL5="$30092,230649,148992,<Full path to file>"
