Technical Information
Malicious functions
Executes the following
- '%ProgramFiles%\internet explorer\iexplore.exe' http://movie.letv.com/
Modifies file system
Creates the following files
- %TEMP%\bt1778.bat
Sets the 'hidden' attribute to the following files
- %TEMP%\bt1778.bat
Deletes the following files
- %TEMP%\bt1778.bat
Network activity
Connects to
- 'mo###.letv.com':80
- 'mo###.le.com':80
- 'mo###.le.com':443
TCP
HTTP GET requests
- http://mo###.letv.com/
- http://mo###.le.com/
Other
- 'mo###.le.com':443
UDP
- DNS ASK mo###.letv.com
- DNS ASK mo###.le.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- ClassName: 'Static' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\bt1778.bat' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\bt1778.bat
