Technical Information
Malicious functions:
Creates and executes the following:
- 'C:\abc.txt' (downloaded from the Internet)
Executes the following:
- 'C:\abc.txt'
- '<SYSTEM32>\cmd.exe' /c c:\abc.txt
Modifies file system:
Creates the following files:
- C:\abc.txt
Network activity:
Connects to:
- 'le###e.3322.org':80
- 'localhost':1038
TCP:
HTTP GET requests:
- http://le###e.3322.org/a.bbb
UDP:
- DNS ASK le###e.3322.org
