Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\svwhcrga.lnk
- <SYSTEM32>\tasks\opera scheduled autoupdate 1044487932
Modifies file system
Creates the following files
- %APPDATA%\microsoft\windows\svwhcrga\rbetrceg.exe
Sets the 'hidden' attribute to the following files
- %APPDATA%\microsoft\windows\svwhcrga\rbetrceg.exe
Deletes itself.
Network activity
Connects to
- 'ms###csi.com':80
- 'ba##ide.in':80
- 'se##.com':443
TCP
HTTP GET requests
- http://www.ms###csi.com/ncsi.txt
HTTP POST requests
- http://ba##ide.in/mlp/
Other
- 'se##.com':443
UDP
- DNS ASK ba##ide.in
- DNS ASK se##.com
Miscellaneous
Creates and executes the following
- '%APPDATA%\microsoft\windows\svwhcrga\rbetrceg.exe'
- '<SYSTEM32>\cmd.exe' /c start "" "%APPDATA%\Microsoft\Windows\svwhcrga\rbetrceg.exe"' (with hidden window)
Executes the following
- '<SYSTEM32>\taskeng.exe' {C1D8A6F1-C607-4978-A114-935E148F204D} S-1-5-21-1238866942-1249195528-555854008-1000:hjtwmprqhsg\user:Interactive:[1]
- '<SYSTEM32>\cmd.exe' /c start "" "%APPDATA%\Microsoft\Windows\svwhcrga\rbetrceg.exe"
