| Infection | Listen | Egg-download |
---|
445 (88%)
135 (10%) | 135 (40%)
500 (40%)
1026 (40%)
44445 (25%) | 445 (68%)
1032 (34%)
1028 (30%) |
|
| Processes | Executables |
---|
MSMSGS.EXE (68%)
random 5/6/7/8/9 character filename | ftpupd.exe (50%)
index.dat (43%)
o (29%)
random 8 character filename |
|
| ...Microsoft\Wireless (61%)
...CurrentVersion\RunServices (35%)full list |
|
| 1:5001684 (78%)
1:2001683 (66%)
1:2000032 (52%)
1:2466 (52%)
555:5555005 (52%)
1:99913 (46%)full list |
|
| FTP |
---|
server=- (69%)
pass=1 (59%)
user=1 (44%)
exec=resource32w.exe (38%)
pass=a (38%)
user=a (34%) |
|
| MD5 | Antivirus labels | Domain |
---|
7d99b0... (16%)
2aa59b... (14%)
04af72... (6%)
0a0261... (6%)
7fdfe3... (6%)
97ac56... (6%)full list | sdbot (59%)
linkbot (48%)
rbot (43%)
poebot (37%)
korgo (30%)
lsabot (30%)full list | SOFTWARE\Classes\Applicat... (100%)
paypal.com (100%)
..έ..Π..Z..\ΠΡΡΡΡ..ΠΡΡX... (43%)full list |
|