Technical Information
Malicious functions:
Creates and executes the following:
- '%WINDIR%\iniciapps.exe'
Executes the following:
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\shell32.dll,OpenAs_RunDLL %WINDIR%\indaia.pps
- '<SYSTEM32>\cmd.exe' /c ""%WINDIR%\ligue.bat" "
Modifies file system:
Creates the following files:
- %WINDIR%\iniciapps.exe
- %WINDIR%\ligue.bat
- %WINDIR%\aline.wma
- %WINDIR%\indaia.pps
Network activity:
Connects to:
- 'ft#.##mposbijus.com':21
- 'localhost':1036
UDP:
- DNS ASK ft#.##mposbijus.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_WINHELP' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
