Technical Information
Malicious functions:
Creates and executes the following:
- '%WINDIR%\Temp\temp00.exe' (downloaded from the Internet)
Executes the following:
- '%WINDIR%\Temp\temp00.exe'
Modifies file system:
Creates the following files:
- %WINDIR%\Temp\temp00.exe
Network activity:
Connects to:
- 'yz##pqyz.ru':80
TCP:
HTTP GET requests:
- http://yz##pqyz.ru/newm002.exe
UDP:
- DNS ASK yz##pqyz.ru
