Technical Information
Malicious functions:
Creates and executes the following:
- '' (downloaded from the Internet)
Modifies file system:
Creates the following files:
- %TEMP%\Aliww.exe
Network activity:
Connects to:
- '63.##1.244.6':80
TCP:
HTTP GET requests:
- http://63.##1.244.6/dl/Aliyun.html
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: ''
Creates and executes the following:
- '%TEMP%\Aliww.exe'
