Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\WNBXxRlepu9U5fq.lnk
Modifies file system:
Creates the following files:
- %ProgramFiles%\GKrC6bdVcpA4hsd.exe
Network activity:
Connects to:
- 'mo###echdi.com':80
- 'li###itopr.com':80
- 'localhost':1036
TCP:
HTTP GET requests:
- http://mo###echdi.com/find.php?g=#######################################
- http://li###itopr.com/main.php?g=#######################################
UDP:
- DNS ASK mo###echdi.com
- DNS ASK li###itopr.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
