Technical Information
Modifies file system
Creates the following files
- <Current directory>\gy3nbdrl.exe
- <Current directory>\config.ini
Moves the following files
- from <Full path to file> to %TEMP%\gy3nbdrl\....\gy3nbdrl
Deletes itself.
Network activity
Connects to
- 'be####tel360.com':1219
- 'te##.##sthotel360.com':80
- 'ht##.##sthotel360.com':80
TCP
HTTP GET requests
- http://te##.##sthotel360.com/001/Tips.txt?44####
- http://ht##.##sthotel360.com/HttpApiGb.ashx?ac#################
UDP
- DNS ASK be####tel360.com
- DNS ASK te##.##sthotel360.com
- DNS ASK ht##.##sthotel360.com
Miscellaneous
Searches for the following windows
- ClassName: 'Progman' WindowName: 'Program Manager'
- ClassName: 'CrossFire' WindowName: ''
Executes the following
- '%WINDIR%\syswow64\ipconfig.exe' /flushdns
