Technical Information
Malicious functions
Creates and executes the following
- '' (downloaded from the Internet)
Modifies file system
Creates the following files
- C:\users\public\documents\dev.exe
- C:\users\public\documents\text.txt
Network activity
Connects to
- 'de########.microsoftmiddlename.tk':80
- '22#.#11.72.47':8848
- 'microsoft.com':80
TCP
HTTP GET requests
- http://de########.microsoftmiddlename.tk/picturess/devs.exe
- http://de########.microsoftmiddlename.tk/picturess/72.47.txt
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
Other
- '22#.#11.72.47':8848
UDP
- DNS ASK de########.microsoftmiddlename.tk
- DNS ASK microsoft.com
Miscellaneous
Creates and executes the following
- 'C:\users\public\documents\dev.exe'
- 'C:\users\public\documents\dev.exe' ' (with hidden window)
