Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\explorer.exe
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\syswow64\explorer.exe
- %WINDIR%\explorer.exe
Modifies file system
Creates the following files
- %TEMP%\áùê±åäöãîä¼þ.ini
Deletes the following files
- %TEMP%\áùê±åäöãîä¼þ.ini
Substitutes the following files
- %TEMP%\áùê±åäöãîä¼þ.ini
Network activity
Connects to
- '11#.#23.15.175':1976
TCP
Other
- '11#.#23.15.175':1976
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: '<File name>.exe'
- ClassName: '' WindowName: 'explorer.exe'
- ClassName: 'Progman' WindowName: ''
- ClassName: 'Proxy Desktop' WindowName: ''
- ClassName: 'SystemTray_Main' WindowName: ''
- ClassName: 'Media Center Tray Applet' WindowName: ''
- ClassName: '' WindowName: 'View Available Networks'
- ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: 'BluetoothNotificationAreaIconWindowClass'
- ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: ''
Executes the following
- '%WINDIR%\syswow64\explorer.exe'
- '%WINDIR%\explorer.exe'
