Technical Information
Malicious functions
Injects code into
the following user processes:
- svchost.exe
Modifies file system
Creates the following files
- %TEMP%\svchost.exe
Deletes following files that it created itself
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\72nooqqm\service[1].htm
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\9yuishes\service[1].htm
Network activity
Connects to
- 'drive.usercontent.google.com':443
- '15#.#4.209.95':80
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?6a##############
- http://15#.#4.209.95/success?su#############################
Other
- 'drive.usercontent.google.com':443
UDP
- DNS ASK drive.usercontent.google.com
Miscellaneous
Creates and executes the following
- '%TEMP%\svchost.exe'
