Technical Information
Modifies file system:
Deletes the following files:
- <DRIVERS>\etc\hosts
Substitutes the HOSTS file.
Network activity:
Connects to:
- 'a.##dlq.net':80
- 'a.##dlq.com':80
- 'b.##dlq.net':80
- '<DNS_SERVER>':80
TCP:
HTTP GET requests:
- http://a.##dlq.net/RemoteList.txt
- http://a.##dlq.com/RemoteList.txt
- http://b.##dlq.net/RemoteList.txt
UDP:
- DNS ASK a.##dlq.net
- DNS ASK a.##dlq.com
- DNS ASK b.##dlq.net
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: 'GINA Logon'
Executes the following:
- '<SYSTEM32>\cmd.exe' /c rd "<DRIVERS>\etcYkB1I" /S /Q
