Technical Information
Malicious functions:
Injects code into
the following user processes:
- AVGCTRL.EXE
Modifies file system:
Creates the following files:
- %ALLUSERSPROFILE%\xis\ogrbab.cwx
- %TEMP%\gfa.beb
- %ALLUSERSPROFILE%\xis\odt.mvh
- %TEMP%\jkv.ylz
Network activity:
UDP:
- DNS ASK google.com
- DNS ASK ib##yjp.pw
- DNS ASK ts###xove.pw
- DNS ASK wg####utmnqr.com
- DNS ASK mw###yhuw.pw
- DNS ASK te##kds.net
- DNS ASK yk##ja.pw
- DNS ASK tp###ibwb.net
- DNS ASK rs###yfgi.in
- DNS ASK yg##o.net
- DNS ASK sy###klrxj.pw
- DNS ASK qs###tvgvrxs.in
- DNS ASK kb###ykow.net
- DNS ASK ke###tzou.net
- DNS ASK ou##uqx.net
- DNS ASK oy###nfmj.in
- DNS ASK dx##u.in
- DNS ASK be##ehqs.in
- DNS ASK qg##zi.in
- DNS ASK sq###vrwfa.com
- DNS ASK fu##a.in
- DNS ASK ji##dg.pw
- DNS ASK ek###qqvql.net
- DNS ASK ch###zpaob.pw
- DNS ASK gg##us.pw
- DNS ASK jl##oujq.in
- DNS ASK qh###tqjipi.in
- DNS ASK gs###zhhmh.com
- DNS ASK uh###qzqpyz.in
- DNS ASK yr##ycrn.in
- DNS ASK op###kjkwn.net
Miscellaneous:
Executes the following:
- '%ProgramFiles%\Windows Media Player\mplayer2.exe'
