Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\firefox default browser agent 84f855268dd559f4
Modifies file system
Creates the following files
- %APPDATA%\wudcewb
Sets the 'hidden' attribute to the following files
- %APPDATA%\wudcewb
Deletes itself.
Network activity
Connects to
- 'db##ns.in':80
- 'gu##yr.cc':80
- 'gr##ndag.ru':80
TCP
HTTP POST requests
- http://db##ns.in/tmp/index.php
- http://gr##ndag.ru/tmp/index.php
UDP
- DNS ASK db##ns.in
- DNS ASK gu##yr.cc
- DNS ASK gr##ndag.ru
- DNS ASK lo####aualov.in.net
