Technical Information
Malicious functions:
Creates and executes the following:
- '<SYSTEM32>\wscript.exe' "<Current directory>\YNDSKmfe1J.vbs" <Full path to file> A
- '<SYSTEM32>\wscript.exe' "<Current directory>\YNDSKmfe1J.vbs" <Full path to file>
Modifies file system:
Creates the following files:
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\setu_java[1].drx
- <Current directory>\YNDSKmfe1J.vbs
Deletes itself.
Network activity:
Connects to:
- '19#.#38.231.9':80
- 'localhost':1036
TCP:
HTTP GET requests:
- http://19#.#38.231.9/setu_java.drx
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'asw_av_popup_wndclass' WindowName: ''
