Technical Information
Malicious functions:
Creates and executes the following:
- 'C:\NTDETBCT.COM'
- '%TEMP%\DNFЕЭЕЭ2.4НкГАІ»µф°ж.exe'
- 'C:\NTDETBCT.COM' (downloaded from the Internet)
Executes the following:
- '<SYSTEM32>\wscript.exe' "%TEMP%\micrsoft.vbs"
Modifies file system :
Creates the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ContentPane[1].aspx
- C:\NTDETBCT.COM
- <SYSTEM32>\imm32.ime
- %TEMP%\DNFЕЭЕЭ2.4НкГАІ»µф°ж.exe
- %TEMP%\micrsoft.vbs
Network activity:
Connects to:
- 'www.80##isk.com':80
- 'localhost':1035
TCP:
HTTP GET requests:
- www.80##isk.com/ContentPane.aspx?do#####################################
UDP:
- DNS ASK www.80##isk.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
