Technical Information
Malicious functions:
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
Executes the following:
- '<SYSTEM32>\netsh.exe' ipsec static delete all
Modifies file system :
Creates the following files:
- %TEMP%\~DF53EB.tmp
Deletes the following files:
- <DRIVERS>\etc\hosts
Network activity:
Connects to:
- '27.##4.61.77':8080
- 'localhost':1038
