Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\cmd.exe' /c c:\bl.bat
- '%ProgramFiles%\Internet Explorer\IEXPLORE.EXE' -Embedding
Modifies file system:
Creates the following files:
- C:\bl.bat
Deletes itself.
Network activity:
Connects to:
- 'ir#####d.o2switch.net':80
- 'po#####.polaris-preview.de':80
- 'ch###bait.com':80
- 'www.af###apo.org':80
- 'es##rm.ch':80
- 'fu###tidoc.it':80
- 'nv####h-alpacas.com':80
- 'www.lo##ting.nl':80
TCP:
HTTP GET requests:
- http://ir#####d.o2switch.net/.3mm57hr/?ac###########################
- http://po#####.polaris-preview.de/.qs5y9/?ac###########################
- http://ch###bait.com/.7qt4m/?ac###########################
- http://www.af###apo.org/.8u4yf52/?ac###########################
- http://es##rm.ch/.bj0wn6z/?ac###########################
- http://fu###tidoc.it/.padypq/?ac###########################
- http://nv####h-alpacas.com/.yf4wq/?ac###########################
- http://www.lo##ting.nl/.rqtsoj1/?ac###########################
UDP:
- DNS ASK ir#####d.o2switch.net
- DNS ASK po#####.polaris-preview.de
- DNS ASK ch###bait.com
- DNS ASK www.af###apo.org
- DNS ASK es##rm.ch
- DNS ASK fu###tidoc.it
- DNS ASK nv####h-alpacas.com
- DNS ASK www.lo##ting.nl
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
