Technical Information
Malicious functions:
Creates and executes the following:
- '%TEMP%\smss.exe' 127.1 -n 5
Executes the following:
- '<SYSTEM32>\attrib.exe' -s -h "<Full path to file>"
- '%ProgramFiles%\Internet Explorer\IEXPLORE.EXE' -Embedding
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\1.tmp.cmd "<Full path to file>""
Modifies file system:
Creates the following files:
- %TEMP%\smss.exe
- %TEMP%\1.tmp.cmd
Deletes itself.
Network activity:
Connects to:
- '74.##5.232.51':80
- 'localhost':1039
TCP:
HTTP POST requests:
- http://www.google.com/ via 74.##5.232.51
UDP:
- DNS ASK www.google.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
