Technical Information
Malicious functions
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system
Creates the following files
- %WINDIR%\client41913.exe
- %WINDIR%\obcwajm.dll
- %WINDIR%\cle.bat
Network activity
Connects to
- 'ud#.#xwan.com':80
- 'cf#.##pinwan.com':80
- 'bk.##7wan.com':80
TCP
HTTP GET requests
- http://cf#.##pinwan.com/index/getcfg?id######
UDP
- DNS ASK ud#.#xwan.com
- DNS ASK cf#.##pinwan.com
- DNS ASK bk.##7wan.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\client41913.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c call %WINDIR%\cle.bat
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 3
- '%WINDIR%\client41913.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c call %WINDIR%\cle.bat' (with hidden window)
