Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\inv.js
Malicious functions:
Creates and executes the following:
- '' (downloaded from the Internet)
Modifies file system:
Creates the following files:
- <Current directory>\inv.exe
Network activity:
Connects to:
- 'be#####tarysaver.win':80
TCP:
HTTP GET requests:
- http://be#####tarysaver.win/landers/FlashPlayer/FlashPlayer.exe
- http://be#####tarysaver.win/landers/FlashPlayer/FlashPlayer-update.js
UDP:
- DNS ASK be#####tarysaver.win
Miscellaneous:
Creates and executes the following:
- '<Current directory>\inv.exe'
Executes the following:
- '<SYSTEM32>\wscript.exe' "%HOMEPATH%\Start Menu\Programs\Startup\inv.js"
