Technical Information
Malicious functions:
Executes the following:
- '%WINDIR%\explorer.exe'
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
Modifies file system :
Creates the following files:
- %APPDATA%\Microsoft\Windows\NMZu9M.cfg
Sets the 'hidden' attribute to the following files:
- %APPDATA%\Microsoft\Windows\NMZu9M.cfg
Network activity:
Connects to:
- '17#.#97.189.158':1182
- 'pr###.sytes.net':81
- 'localhost':1036
UDP:
- DNS ASK pr###.sytes.net
