Technical Information
Malicious functions
Injects code into
the following user processes:
- iexplore.exe
Modifies file system
Creates the following files
- %TEMP%\nsacc35.tmp
- %TEMP%\loadadv579.exe
- %TEMP%\163.exe
- %TEMP%\guyi1234.exe
- %WINDIR%\syswow64\ldcore.dll
- %TEMP%\nsad559.tmp
- %TEMP%\lll.txt
- %TEMP%\lll.exe
Network activity
UDP
- DNS ASK ch###.ic-soft.cn
Miscellaneous
Creates and executes the following
- '%TEMP%\loadadv579.exe'
- '%TEMP%\163.exe'
- '%TEMP%\guyi1234.exe'
- '%TEMP%\lll.exe'
