Technical Information
Malicious functions:
Executes the following:
- <SYSTEM32>\wscript.exe c:\120015.vbs
- <SYSTEM32>\rundll32.exe "C:\NVIDIA\DisplayDriver\wupdmgr32.dll" start007
Modifies file system :
Creates the following files:
- C:\120015.vbs
- C:\NVIDIA\DisplayDriver\wupdmgr32.dll
Deletes the following files:
- C:\120015.vbs
Deletes itself.
Network activity:
Connects to:
- 'ba####020.gicp.net':3030
UDP:
- DNS ASK ba####020.gicp.net