Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\net1.exe' stop AVG RESIDENT SHIELD
- '<SYSTEM32>\net.exe' stop "avast! iAVS4 Control Service"
- '<SYSTEM32>\net1.exe' stop "Panda Antivirus"
- '<SYSTEM32>\net.exe' stop "McShield"
- '<SYSTEM32>\net1.exe' stop ghost
- '<SYSTEM32>\net.exe' stop "avast! Antivirus"
- '<SYSTEM32>\net1.exe' stop "McShield"
- '<SYSTEM32>\net.exe' stop "nod32kui"
- '<SYSTEM32>\net1.exe' stop "avast! Antivirus"
- '<SYSTEM32>\net.exe' stop "AVG6 Service"
- '<SYSTEM32>\net1.exe' stop panda
- '<SYSTEM32>\net.exe' stop "AVG RESIDENT SHIELD"
- '<SYSTEM32>\net1.exe' stop eventlog
- '<SYSTEM32>\net.exe' stop ghost
- '<SYSTEM32>\net1.exe' stop McAfeeFramework
- '<SYSTEM32>\net.exe' stop Aavgupsvc
- '<SYSTEM32>\net1.exe' stop GhostStartService
- '<SYSTEM32>\net.exe' stop GhostStartTrayApp
- '<SYSTEM32>\net1.exe' stop Aavgupsvc
- '<SYSTEM32>\net.exe' stop panda
- '<SYSTEM32>\net1.exe' stop GhostStartTrayApp
- '<SYSTEM32>\net.exe' stop AVG RESIDENT SHIELD
- '<SYSTEM32>\net1.exe' stop MCVSrte
- '<SYSTEM32>\net.exe' stop "Panda Antivirus"
- '<SYSTEM32>\net.exe' stop "AVG7 Alert Manager Server"
- '<SYSTEM32>\net1.exe' stop nod32krn.exe
- '<SYSTEM32>\net.exe' stop "AVG7 Update Service"
- '<SYSTEM32>\net1.exe' stop nod32krn
- '<SYSTEM32>\net.exe' stop "NAV Alert"
- '<SYSTEM32>\net1.exe' stop "nod32krn.exe"
- '<SYSTEM32>\net1.exe' stop "AVG7 Alert Manager Server"
- '<SYSTEM32>\net1.exe' stop "AVG7 Update Service"
- '<SYSTEM32>\net1.exe' stop "McAfee.com McShield"
- '<SYSTEM32>\net.exe' stop "McAfee.com McShield"
- '<SYSTEM32>\net1.exe' stop "ZoneAlarm"
- '<SYSTEM32>\net1.exe' stop "NAV Alert"
- '<SYSTEM32>\net1.exe' stop "AVG6 Service"
- '<SYSTEM32>\net.exe' stop nod32krn
- '<SYSTEM32>\net1.exe' stop "AVG RESIDENT SHIELD"
- '<SYSTEM32>\net.exe' stop nod32kui
- '<SYSTEM32>\net1.exe' stop "avast! iAVS4 Control Service"
- '<SYSTEM32>\net.exe' stop "nod32krn"
- '<SYSTEM32>\net1.exe' stop nod32kui
- '<SYSTEM32>\net1.exe' stop "nod32krn"
- '<SYSTEM32>\net.exe' stop "ZoneAlarm"
- '<SYSTEM32>\net.exe' stop "nod32krn.exe"
- '<SYSTEM32>\net1.exe' stop "nod32kui"
- '<SYSTEM32>\net.exe' stop nod32krn.exe
- '<SYSTEM32>\net1.exe' stop Norton
- '<SYSTEM32>\net.exe' stop RESCUE32
- '<SYSTEM32>\net1.exe' stop NAVWNT
- '<SYSTEM32>\net.exe' stop NAVLU32
- '<SYSTEM32>\net1.exe' stop MCAFEE
- '<SYSTEM32>\net.exe' stop NAVAPSVC
- '<SYSTEM32>\net1.exe' stop NAVLU32
- '<SYSTEM32>\net.exe' stop NAVAPW32
- '<SYSTEM32>\net1.exe' stop NAVAPSVC
- '<SYSTEM32>\net.exe' stop NMAIN
- '<SYSTEM32>\net1.exe' stop NAVRUNR
- '<SYSTEM32>\net.exe' stop NAVW32
- '<SYSTEM32>\net.exe' stop ANTIVIR
- '<SYSTEM32>\net.exe' stop MCAFEE
- '<SYSTEM32>\net1.exe' stop "Security Center"
- '<SYSTEM32>\net.exe' stop "Security Center"
- '<SYSTEM32>\net.exe' stop SharedAccess
- '<SYSTEM32>\net.exe' stop SAFEWEB
- '<SYSTEM32>\net1.exe' stop SAFEWEB
- '<SYSTEM32>\net.exe' stop NAVRUNR
- '<SYSTEM32>\net1.exe' stop ANTIVIR
- '<SYSTEM32>\net.exe' stop Norton
- '<SYSTEM32>\net1.exe' stop SharedAccess
- '<SYSTEM32>\net.exe' stop NAVWNT
- '<SYSTEM32>\net.exe' stop McShield
- '<SYSTEM32>\net1.exe' stop avgemc
- '<SYSTEM32>\net.exe' stop GhostStartService
- '<SYSTEM32>\net1.exe' stop avgupsvc
- '<SYSTEM32>\net.exe' stop mcagent.exe
- '<SYSTEM32>\net1.exe' stop avgamsvr
- '<SYSTEM32>\net1.exe' stop mcagent.exe
- '<SYSTEM32>\net.exe' stop MCVSrte
- '<SYSTEM32>\net1.exe' stop McShield
- '<SYSTEM32>\net.exe' stop eventlog
- '<SYSTEM32>\net1.exe' stop McVSEscn.exe
- '<SYSTEM32>\net.exe' stop McAfeeFramework
- '<SYSTEM32>\net1.exe' stop NMAIN
- '<SYSTEM32>\net.exe' stop avgupsvc
- '<SYSTEM32>\net1.exe' stop NAVW32
- '<SYSTEM32>\net.exe' stop scanner.exe
- '<SYSTEM32>\net1.exe' stop RESCUE32
- '<SYSTEM32>\net.exe' stop scanner
- '<SYSTEM32>\net1.exe' stop scanner.exe
- '<SYSTEM32>\net1.exe' stop scanner
- '<SYSTEM32>\net.exe' stop McVSEscn.exe
- '<SYSTEM32>\net.exe' stop avgamsvr
- '<SYSTEM32>\net1.exe' stop NAVAPW32
- '<SYSTEM32>\net.exe' stop avgemc
Modifies file system :
Modifies the HOSTS file.
Network activity:
Connects to:
- '19#.#4.136.180':80
TCP:
HTTP GET requests:
- 19#.#4.136.180/manezeca_hosts.txt
HTTP POST requests:
- 19#.#4.136.180/manezeca/admin.php?gb########################