Technical Information
Modifies file system:
Creates the following files:
- <SYSTEM32>\myini.ini
- %TEMP%\khdlj.ini
Network activity:
Connects to:
- 'dk.##900.com':900
- 'a.##cs.com':80
- 'b.##cs.com':80
- 'c.##cs.com':80
- 'AB#.#5cs.com':80
TCP:
HTTP GET requests:
- http://a.##cs.com/hosts.txt
- http://b.##cs.com/hosts.txt
- http://c.##cs.com/hosts.txt
- http://AB#.#5cs.com/hosts.txt
UDP:
- DNS ASK dk.##900.com
- DNS ASK a.##cs.com
- DNS ASK b.##cs.com
- DNS ASK c.##cs.com
- DNS ASK AB#.#5cs.com
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: '??????'
- ClassName: '' WindowName: 'ЎЎЎЎЎЎ'
- ClassName: '' WindowName: 'GINA Logon'
