Technical Information
- '%TEMP%\169828.exe' (downloaded from the Internet)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\ytk.bat" "<Full path to file>" "
- '%TEMP%\169828.exe'
- [<HKCU>\SOFTWARE\NCH Software\Fling\Accounts]
- [<HKCU>\Software\NCH Software\ClassicFTP\FTPAccounts]
- [<HKLM>\Software\NCH Software\ClassicFTP\FTPAccounts]
- [<HKLM>\Software\FTPClient\Sites]
- [<HKCU>\Software\FTPClient\Sites]
- [<HKLM>\SOFTWARE\NCH Software\Fling\Accounts]
- [<HKCU>\Software\ExpanDrive\Sessions]
- [<HKCU>\Software\FTPWare\COREFTP\Sites]
- [<HKCU>\Software\CoffeeCup Software\Internet\Profiles]
- [<HKCU>\Software\Sota\FFFTP\Options]
- [<HKCU>\Software\Cryer\WebSitePublisher]
- [<HKCU>\Software\VanDyke\SecureFX]
- [<HKCU>\Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224]
- [<HKCU>\Software\SoftX.org\FTPClient\Sites]
- [<HKLM>\SOFTWARE\Robo-FTP 3.7\Scripts]
- [<HKCU>\SOFTWARE\Robo-FTP 3.7\Scripts]
- [<HKLM>\SOFTWARE\Robo-FTP 3.7\FTPServers]
- [<HKLM>\Software\SimonTatham\PuTTY\Sessions]
- [<HKCU>\Software\SimonTatham\PuTTY\Sessions]
- [<HKCU>\Software\LinasFTP\Site Manager]
- [<HKCU>\SOFTWARE\Robo-FTP 3.7\FTPServers]
- [<HKLM>\Software\Martin Prikryl]
- [<HKCU>\Software\Martin Prikryl]
- [<HKLM>\Software\SoftX.org\FTPClient\Sites]
- [<HKCU>\Software\FlashPeak\BlazeFtp\Settings]
- [<HKLM>\Software\South River Technologies\WebDrive\Connections]
- [<HKCU>\Software\South River Technologies\WebDrive\Connections]
- [<HKCU>\Software\Sota\FFFTP]
- [<HKCU>\Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar]
- [<HKCU>\Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar]
- [<HKCU>\Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar]
- [<HKCU>\Software\FlashFXP\3]
- [<HKCU>\Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar]
- [<HKCU>\Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar]
- [<HKCU>\Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar]
- [<HKCU>\Software\Ghisler\Windows Commander]
- [<HKCU>\Software\Far2\SavedDialogHistory\FTPHost]
- [<HKCU>\Software\Far\SavedDialogHistory\FTPHost]
- [<HKLM>\Software\Ghisler\Total Commander]
- [<HKCU>\Software\Ghisler\Total Commander]
- [<HKLM>\Software\Ghisler\Windows Commander]
- [<HKCU>\Software\FlashFXP]
- [<HKCU>\Software\BulletProof Software\BulletProof FTP Client\Options]
- [<HKCU>\Software\BPFTP\Bullet Proof FTP\Options]
- [<HKCU>\Software\BulletProof Software\BulletProof FTP Client\Main]
- [<HKLM>\Software\TurboFTP]
- [<HKCU>\Software\TurboFTP]
- [<HKCU>\Software\BPFTP]
- [<HKCU>\Software\BPFTP\Bullet Proof FTP\Main]
- [<HKCU>\Software\FileZilla]
- [<HKLM>\Software\FlashFXP]
- [<HKLM>\Software\FlashFXP\3]
- [<HKLM>\Software\FileZilla Client]
- [<HKLM>\Software\FileZilla]
- [<HKCU>\Software\FileZilla Client]
- %TEMP%\ytk.bat
- %TEMP%\169828.exe
- 'ba###-a-tm.com':80
- 'ft#.##isystems.com':80
- 'bi###buy.com':80
- 'au####ink.com.au':80
- 'co###pod.com':80
- 'co###pride.com':80
- 'ma###sale.com':80
- http://ft#.##isystems.com/_mmx14rf.exe
- http://bi###buy.com/_mmx14rf.exe
- http://au####ink.com.au/_mmx14rf.exe
- http://ba###-a-tm.com/_mmx14rf.exe
- http://ma###sale.com/pony/gate.php
- http://co###pride.com/pony/gate.php
- http://co###pod.com/pony/gate.php
- DNS ASK ba###-a-tm.com
- DNS ASK ft#.##isystems.com
- DNS ASK bi###buy.com
- DNS ASK au####ink.com.au
- DNS ASK co###pod.com
- DNS ASK co###pride.com
- DNS ASK ma###sale.com