Technical Information
Malicious functions:
Creates and executes the following:
- '' (downloaded from the Internet)
Modifies file system:
Creates the following files:
- %TEMP%\7zS43B13632\setup.exe
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\explorer[1].exe
- %TEMP%\7zS01BF32D1\fVIusWAB.exe
- %TEMP%\7zS01BF32D1\setup.exe
Deletes the following files:
- %TEMP%\7zS01BF32D1\fVIusWAB.exe
Network activity:
Connects to:
- '17#.#04.65.137':80
TCP:
HTTP GET requests:
- http://17#.#04.65.137/explorer.exe
Miscellaneous:
Creates and executes the following:
- '%TEMP%\explorer.exe'
- '%TEMP%\7zS43B13632\setup.exe'
- '%TEMP%\7zS01BF32D1\setup.exe'
- '%TEMP%\7zS01BF32D1\fVIusWAB.exe'
Executes the following:
- '<SYSTEM32>\cmd.exe' /c %TEMP%\explorer.exe
