Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\nvngxupdatecheckdaily_{5d7c6d5b-6d5b-6d5b-6d5b-5d7c6d5b6d5b}
Modifies file system
Creates the following files
- %TEMP%\9a26.tmp
- %APPDATA%\wivjshe
Sets the 'hidden' attribute to the following files
- %APPDATA%\wivjshe
Deletes itself.
Network activity
Connects to
- 'xi###orn.com':80
- 'ka##uelo.co':80
- 'pi###slel.is':80
- 'da##e.to':80
- '3r##amp.ga':80
- 'th##rd.ml':80
TCP
HTTP POST requests
- http://xi###orn.com/
- http://ka##uelo.co/
- http://pi###slel.is/
- http://da##e.to/
- http://3r##amp.ga/
- http://th##rd.ml/
UDP
- DNS ASK xi###orn.com
- DNS ASK ka##uelo.co
- DNS ASK pi###slel.is
- DNS ASK da##e.to
- DNS ASK 3r##amp.ga
- DNS ASK th##rd.ml
