but I'd like more information if possible. My own rather simplistic analysis showed these files in the zip as files from the malware "Popper." I found little on google about popper. I do know that it attaches itself to IE in the registry under \Software\Microsoft\Internet Explorer\New Windows\ (along with a couple of others), connects to a website to download a .bin file, and downloads itself if it finds itself corrupted or cannot run for whatever the reason (freaky o_O), but that's about the extent of my analysis. What I am asking is anything else, such as dll files it creates, registry edits, and anything else I need to watch out for. I found these files on a computer at work. I got suspicious when these files would eat cpu everytime IE was launched or went to a website, and a popup window soon after came up.
|