Technical Information
Modifies file system
Creates the following files
- %WINDIR%\temp\setup.exe
- %WINDIR%\temp\svchost.exe
- <SYSTEM32>\contextmu.dll
Network activity
Connects to
- 'dl#.#vasp.cn':80
TCP
HTTP GET requests
- http://dl#.#vasp.cn/cpa/cpa.txt
UDP
- DNS ASK dl#.#vasp.cn
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%WINDIR%\temp\setup.exe'
- '%WINDIR%\temp\svchost.exe'
Executes the following
- '<SYSTEM32>\regsvr32.exe' /s <SYSTEM32>\ContextMu.dll
