Technical Information
Malicious functions:
Creates and executes the following:
- '%WINDIR%\Build70.exe' (downloaded from the Internet)
Executes the following:
- '%WINDIR%\Build70.exe'
Modifies file system:
Creates the following files:
- %WINDIR%\Build70.exe
Network activity:
Connects to:
- 'pt##v.org':80
- 'localhost':1036
TCP:
HTTP GET requests:
- http://pt##v.org/magreen.jpg
UDP:
- DNS ASK pt##v.org
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_WINHELP' WindowName: ''
