Technical Information
Malicious functions:
Creates and executes the following:
- %WINDIR%\system\svchost.exeЎЎ "%TEMP%\\31.exe" "%TEMP%\\9.exe" "%TEMP%\\38.exe" "%TEMP%\\40.exe" "%TEMP%\\42.exe" "%TEMP%\\34.exe" "%TEMP%\\24.exe" "%TEMP%\\20.exe" "%TEMP%\\11.exe" "%TEMP%\\32.exe" "%TEMP%\\16.exe" "%TEMP%\\29.exe" "%TEMP%\\35.exe" "%TEMP%\\15.exe" "%TEMP%\\41.exe" "%TEMP%\\19.exe" "%TEMP%\\27.exe" "%TEMP%\\37.exe" "%TEMP%\\25.exe" "%TEMP%\\33.exe" "%TEMP%\\21.exe" "%TEMP%\\39.exe" "%TEMP%\\8.exe" "%TEMP%\\5.exe" "%TEMP%\\12.exe" "%TEMP%\\1.exe" "%TEMP%\\6.exe" "%TEMP%\\14.exe" "%TEMP%\\4.exe" "%TEMP%\\2.exe" "%TEMP%\\0.exe" "%TEMP%\\10.exe" "%TEMP%\\23.exe" "%TEMP%\\36.exe" "%TEMP%\\26.exe" "%TEMP%\\22.exe" "%TEMP%\\17.exe" "%TEMP%\\28.exe" "%TEMP%\\7.exe" "%TEMP%\\3.exe" "%TEMP%\\30.exe" "%TEMP%\\18.exe" "%TEMP%\\13.exe"
Modifies file system :
Creates the following files:
- %TEMP%\1
- %WINDIR%\system\svchost.exeЎЎ
Network activity:
Connects to:
- 'xx.cn':80
TCP:
HTTP GET requests:
- xx.cn/down.txt
UDP:
- DNS ASK xx.cn
