Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\nvngxupdatecheckdaily_{a6b397e0-97e0-97e0-97e0-a6b397e097e0}
Modifies file system
Creates the following files
- %TEMP%\cc4f.tmp
- %APPDATA%\hjsgvst
- %APPDATA%\fghceig
Sets the 'hidden' attribute to the following files
- %APPDATA%\hjsgvst
- %APPDATA%\fghceig
Deletes itself.
Network activity
Connects to
- 'vg###isv.com':80
- 'vu###faste.ru':80
- 'vu###faste.shop':80
TCP
HTTP POST requests
- http://vg###isv.com/upload/
- http://vu###faste.ru/upload/
- http://vu###faste.shop/upload/
UDP
- DNS ASK vg###isv.com
- DNS ASK ju##ga.com
- DNS ASK vu###faste.ru
- DNS ASK vu###faste.shop
