Technical Information
Malicious functions:
Creates and executes the following:
- C:\13fa455dfb255bc4745f029e\update\update.exe
Modifies file system :
Creates the following files:
- C:\13fa455dfb255bc4745f029e\_sfx_0006._p
- C:\13fa455dfb255bc4745f029e\_sfx_0001._p
- C:\13fa455dfb255bc4745f029e\_sfx_0002._p
- C:\13fa455dfb255bc4745f029e\_sfx_0000._p
- %WINDIR%\KB970653-v3.log
- <SYSTEM32>\TZLog.log
- C:\13fa455dfb255bc4745f029e\update\tzchange.dll
- C:\13fa455dfb255bc4745f029e\$shtdwn$.req
- C:\13fa455dfb255bc4745f029e\_sfx_0005._p
- C:\13fa455dfb255bc4745f029e\update\update.ver
- C:\13fa455dfb255bc4745f029e\_sfx_.dll
- %TEMP%\pba1.tmp
- %TEMP%\mfa2.tmp
- C:\13fa455dfb255bc4745f029e\_sfx_0004._p
- C:\13fa455dfb255bc4745f029e\_sfx_0008._p
- C:\13fa455dfb255bc4745f029e\_sfx_0007._p
- C:\13fa455dfb255bc4745f029e\_sfx_0003._p
- C:\13fa455dfb255bc4745f029e\_sfx_0009._p
Deletes the following files:
- C:\13fa455dfb255bc4745f029e\_sfx_0007._p
- C:\13fa455dfb255bc4745f029e\_sfx_0006._p
- C:\13fa455dfb255bc4745f029e\_sfx_0005._p
- C:\13fa455dfb255bc4745f029e\_sfx_.dll
- C:\13fa455dfb255bc4745f029e\_sfx_0009._p
- C:\13fa455dfb255bc4745f029e\_sfx_0008._p
- C:\13fa455dfb255bc4745f029e\_sfx_0001._p
- C:\13fa455dfb255bc4745f029e\_sfx_0000._p
- %TEMP%\pba1.tmp
- C:\13fa455dfb255bc4745f029e\_sfx_0004._p
- C:\13fa455dfb255bc4745f029e\_sfx_0003._p
- C:\13fa455dfb255bc4745f029e\_sfx_0002._p
Network activity:
Connects to:
- '17####o.3322.org':808
- 'localhost':1036
UDP:
- DNS ASK 17####o.3322.org
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
