Technical Information
Malicious functions:
Executes the following:
- '%WINDIR%\explorer.exe'
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
Modifies file system:
Creates the following files:
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\index[1].htm
Network activity:
Connects to:
- 'wi#.##gosysco.org':80
- 'sy#.#ignums.net':80
- 'au#.##sclubs.org':80
TCP:
HTTP POST requests:
- http://wi#.##gosysco.org/index.php
- http://sy#.#ignums.net/index.php
UDP:
- DNS ASK wi#.##gosysco.org
- DNS ASK sy#.#ignums.net
- DNS ASK au#.##sclubs.org
