Technical Information
Malicious functions:
Creates and executes the following:
- '%TEMP%\ivnakc.exe' (downloaded from the Internet)
Executes the following:
- '%TEMP%\ivnakc.exe'
- '<SYSTEM32>\ping.exe' 127.0.0.1
- '<SYSTEM32>\cmd.exe' /c %TEMP%\ltvgapc.bat
- '<SYSTEM32>\cmd.exe' /c %TEMP%\fiiuqmc.bat
- '%TEMP%\kqefgc.exe'
Modifies file system:
Creates the following files:
- %TEMP%\ivnakc.exe
- %TEMP%\savfko.bat
- %TEMP%\ltvgapc.bat
- %TEMP%\kqefgc.exe
- %TEMP%\cgrocp.bat
- %TEMP%\fiiuqmc.bat
Deletes the following files:
- %TEMP%\nfetxmgo.bat
- %TEMP%\ucsndcwv.bat
Moves the following files:
- from %TEMP%\savfko.bat to %TEMP%\nfetxmgo.bat
- from %TEMP%\cgrocp.bat to %TEMP%\ucsndcwv.bat
Deletes itself.
Network activity:
Connects to:
- 'www.10##u.info':80
- 'localhost':1036
TCP:
HTTP GET requests:
- http://www.10##u.info/7ff.exe
UDP:
- DNS ASK www.10##u.info
