Technical Information
Malicious functions:
Creates and executes the following:
- '%TEMP%\javainstall3.exe'
- '%TEMP%\javainstall4.exe'
- '%TEMP%\javainstall5.exe'
- '%TEMP%\javainstall1.exe'
- '%TEMP%\javainstall2.exe'
- '%TEMP%\javainstall4.exe' (downloaded from the Internet)
- '%TEMP%\javainstall5.exe' (downloaded from the Internet)
- '%TEMP%\javainstall2.exe' (downloaded from the Internet)
- '%TEMP%\javainstall3.exe' (downloaded from the Internet)
- '%TEMP%\javainstall1.exe' (downloaded from the Internet)
Modifies file system :
Creates the following files:
- %TEMP%\javainstall3.txt
- %TEMP%\javainstall4.txt
- %TEMP%\javainstall5.txt
- %TEMP%\javainstall2.txt
- %TEMP%\nsk2.tmp
- %TEMP%\nsv3.tmp\inetc2.dll
- %TEMP%\javainstall1.txt
Deletes the following files:
- %TEMP%\javainstall4.exe
- %TEMP%\javainstall5.exe
- %TEMP%\nsv3.tmp\inetc2.dll
- %TEMP%\javainstall1.exe
- %TEMP%\javainstall2.exe
- %TEMP%\javainstall3.exe
Moves the following files:
- from %TEMP%\javainstall4.txt to %TEMP%\javainstall4.exe
- from %TEMP%\javainstall5.txt to %TEMP%\javainstall5.exe
- from %TEMP%\javainstall3.txt to %TEMP%\javainstall3.exe
- from %TEMP%\javainstall1.txt to %TEMP%\javainstall1.exe
- from %TEMP%\javainstall2.txt to %TEMP%\javainstall2.exe
Network activity:
Connects to:
- 'www.aw###stalls.com':80
TCP:
HTTP GET requests:
- www.aw###stalls.com/dl/index.cgi?ci#############################################
UDP:
- DNS ASK www.aw###stalls.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: '#32770' WindowName: '(null)'
