Technical Information
Malicious functions:
Creates and executes the following:
- "%TEMP%\7.tmp" (downloaded from the Internet)
- "%TEMP%\6.tmp" (downloaded from the Internet)
- "%TEMP%\8.tmp" (downloaded from the Internet)
- "%TEMP%\A.tmp" (downloaded from the Internet)
- "%TEMP%\9.tmp" (downloaded from the Internet)
- "%TEMP%\2.tmp" (downloaded from the Internet)
- "%TEMP%\1.tmp" (downloaded from the Internet)
- "%TEMP%\3.tmp" (downloaded from the Internet)
- "%TEMP%\5.tmp" (downloaded from the Internet)
- "%TEMP%\4.tmp" (downloaded from the Internet)
Executes the following:
- <SYSTEM32>\svchost.exe
Modifies file system :
Creates the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\load[4].php
- %TEMP%\7.tmp
- %TEMP%\8.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\load[4].php
- %TEMP%\6.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\load[3].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\load[4].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\load[3].php
- %TEMP%\A.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\load[5].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\load[6].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\load[5].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\load[5].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\load[4].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\load[5].php
- %TEMP%\9.tmp
- %TEMP%\2.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\load[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\load[2].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\load[1].php
- %TEMP%\1.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\load[1].php
- <Current directory>\&luck=1
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\load[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\load[3].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\load[2].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\load[3].php
- %TEMP%\5.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\load[2].php
- %TEMP%\3.tmp
- %TEMP%\4.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\load[2].php
Deletes itself.
Network activity:
Connects to:
- 'pr##.com':80
- 'localhost':1034
TCP:
HTTP GET requests:
- pr##.com/xpg/load.php?fi###########
- pr##.com/xpg/load.php?fi####
UDP:
- DNS ASK pr##.com
- '<Private IP address>':1035
