Technical Information
Malicious functions:
Creates and executes the following:
- %TEMP%\9.tmp
- %TEMP%\4.tmp
- %TEMP%\7.tmp
- %TEMP%\8.tmp
- %TEMP%\6.tmp
- %TEMP%\5.tmp
- <Current directory>\rfuQjdkFYy.exe
- %TEMP%\1.tmp
- %TEMP%\2.tmp
- %TEMP%\3.tmp
- %TEMP%\A.tmp
- %TEMP%\9.tmp (downloaded from the Internet)
- %TEMP%\A.tmp (downloaded from the Internet)
- %TEMP%\8.tmp (downloaded from the Internet)
- %TEMP%\7.tmp (downloaded from the Internet)
- %TEMP%\3.tmp (downloaded from the Internet)
- %TEMP%\2.tmp (downloaded from the Internet)
- %TEMP%\1.tmp (downloaded from the Internet)
- %TEMP%\6.tmp (downloaded from the Internet)
- %TEMP%\5.tmp (downloaded from the Internet)
- %TEMP%\4.tmp (downloaded from the Internet)
Executes the following:
- <SYSTEM32>\svchost.exe
- <SYSTEM32>\cmd.exe /c flzvsstXSk.bat
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system :
Creates the following files:
- %TEMP%\7.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\load[4].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\load[4].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\load[4].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\load[3].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\load[3].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\load[3].php
- %TEMP%\6.tmp
- %TEMP%\8.tmp
- %TEMP%\A.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\load[5].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\load[6].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\load[5].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\load[5].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\load[4].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\load[5].php
- %TEMP%\9.tmp
- <Current directory>\&luck=1
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\load[1].php
- %TEMP%\2.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\load[1].php
- <Current directory>\rfuQjdkFYy.exe
- <Current directory>\flzvsstXSk.bat
- %TEMP%\1.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\load[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\load[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\load[2].php
- %TEMP%\4.tmp
- %TEMP%\5.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\load[3].php
- %TEMP%\3.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\load[2].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\load[2].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\load[2].php
Deletes the following files:
- <Current directory>\rfuQjdkFYy.exe
Deletes itself.
Network activity:
Connects to:
- 'da##ers.ru':80
- 'localhost':1036
TCP:
HTTP GET requests:
- da##ers.ru/load.php?fi###########
- da##ers.ru/load.php?fi####
UDP:
- DNS ASK da##ers.ru