Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\iexpl0re.lnk
Malicious functions
Injects code into
the following user processes:
- svchost.exe
Modifies file system
Creates the following files
- %HOMEPATH%\iexpl0re.exe
- %TEMP%\svchost.exe
- %TEMP%\14aa71.dat
- %HOMEPATH%\mscmos.sys
Network activity
Connects to
- '17#.#6.2.214':80
- '20#.#6.11.22':80
Miscellaneous
Creates and executes the following
- '%TEMP%\svchost.exe' "<Full path to file>"
