Technical Information
Malicious functions:
Injects code into
the following system processes:
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe
Modifies file system:
Creates the following files:
- <Full path to file>:ZONE.identifier
Sets the 'hidden' attribute to the following files:
- <Full path to file>
Network activity:
Connects to:
- 'localhost':1038
Miscellaneous:
Executes the following:
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe'
- '<SYSTEM32>\cmd.exe' /c echo [zoneTransfer]ZoneID = 2 > "<Full path to file>":ZONE.identifier & exit
