Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen <Current directory>\xxx.bmp
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\BaoFeng\StormPlayer.exe
- %PROGRAM_FILES%\BaoFeng\StormPlayer.dll
Moves itself:
- from <Full path to virus> to %PROGRAM_FILES%\Win177750.exe
Network activity:
Connects to:
- 'www.ip##8.com':80
UDP:
- DNS ASK www.ip##8.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'kxetray' WindowName: '(null)'