Technical Information
Malicious functions:
Creates and executes the following:
- '' (downloaded from the Internet)
Modifies file system:
Creates the following files:
- %APPDATA%\SteamService.exe
- %HOMEPATH%\My Documents\4n3gy8n43g7gh.exe
- %HOMEPATH%\My Documents\Screen_743784364387844.jpg
Network activity:
Connects to:
- 'wp#d':80
- 'ci####0.tmweb.ru':80
TCP:
HTTP GET requests:
- http://11#.#11.111.1/wpad.dat via wp#d
- http://ci####0.tmweb.ru/task.jpg
- http://ci####0.tmweb.ru/QLWGDUIGWFUOG.jpg
- http://ci####0.tmweb.ru/111111.jpg
UDP:
- DNS ASK wp#d
- DNS ASK ci####0.tmweb.ru
Miscellaneous:
Searches for the following windows:
- ClassName: 'ShImgVw:CPreviewWnd' WindowName: ''
Creates and executes the following:
- '%APPDATA%\SteamService.exe'
- '%HOMEPATH%\My Documents\4n3gy8n43g7gh.exe'
Executes the following:
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %HOMEPATH%\My Documents\Screen_743784364387844.jpg
