Technical Information
Malicious functions
Creates and executes the following (exploit)
- 'C:\Documents\user\locals~1\temp\ibm_cnitil.exe'
Modifies file system
Creates the following files
- C:\Documents\user\locals~1\temp\~df89e9.tmp
- C:\Documents\user\locals~1\temp\ibm_cnitil.exe
- %HOMEPATH%\templates\strygende\ridered\aftest\fatbird.bar
- %HOMEPATH%\templates\strygende\ridered\aftest\internments\disdiplomatize.ove
- %HOMEPATH%\templates\strygende\ridered\aftest\internments\pampas.sni
- C:\Documents\user\locals~1\temp\nsm3.tmp\system.dll
Network activity
Connects to
- '10#.6.248.9':80
TCP
HTTP GET requests
- http://10#.6.248.9/W267T/wininit.exe
Miscellaneous
Searches for the following windows
- ClassName: 'Ghost' WindowName: ''
- ClassName: 'MsoHelp11' WindowName: ''
- ClassName: 'AgentAnim' WindowName: ''
Executes the following
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
