Technical Information
Malicious functions:
Creates and executes the following:
- %WINDIR%\WinUpdaterstd\svchost.exe
Modifies file system :
Creates the following files:
- %WINDIR%\WinUpdaterstd\vistas.dll
- %WINDIR%\WinUpdaterstd\svchost.exe
Deletes the following files:
- %WINDIR%\WinUpdaterstd\vistas.dll
Network activity:
Connects to:
- 'po##adi.net':80
TCP:
HTTP GET requests:
- po##adi.net/1/getcmd.php?id##################
UDP:
- DNS ASK po##adi.net
