Technical Information
Malicious functions:
Creates and executes the following:
- '%TEMP%\temp1214645858.exe'
- '%TEMP%\temp1214645858.exe' (downloaded from the Internet)
Executes the following:
- '%ProgramFiles%\Internet Explorer\IEXPLORE.EXE'
Injects code into
the following user processes:
- IEXPLORE.EXE
Modifies file system:
Creates the following files:
- %TEMP%\temp1214645858.exe
Network activity:
Connects to:
- '21#.#05.20.112':80
TCP:
HTTP GET requests:
- http://21#.#05.20.112/rgoywwf.exe
Miscellaneous:
Searches for the following windows:
- ClassName: 'Progman' WindowName: ''
