Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\AppStarter-4015090625.bat
Malicious functions:
Creates and executes the following:
- '%APPDATA%\Microsoft\Windows\cache_4015090625.exe'
Modifies file system:
Creates the following files:
- %TEMP%\command.txt
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\win[1].zz
- %APPDATA%\Microsoft\Windows\cache_4015090625.exe
Network activity:
Connects to:
- 'm1##.netai.net':80
TCP:
HTTP GET requests:
- http://m1##.netai.net/win.zz
UDP:
- DNS ASK m1##.netai.net
