Technical Information
Modifies file system:
Creates the following files:
- <SYSTEM32>\myini.ini
Network activity:
Connects to:
- 'dk.##900.com':900
- 'a.##cs.com':80
- 'b.##cs.com':80
- 'c.##cs.com':80
- 'ab#.#5cs.com':80
TCP:
HTTP GET requests:
- http://a.##cs.com/hosts.txt
- http://b.##cs.com/hosts.txt
- http://c.##cs.com/hosts.txt
- http://AB#.#5cs.com/hosts.txt via ab#.#5cs.com
UDP:
- DNS ASK dk.##900.com
- DNS ASK a.##cs.com
- DNS ASK b.##cs.com
- DNS ASK c.##cs.com
- DNS ASK AB#.#5cs.com
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: 'GINA Logon'
