A Revolution is the Solution
It tries to install TFactory (from a Malaysian IP Address) first. If successful it then tries to download further malware from Ukrainian addresses.
Whoops, should have made it clearer - I meant what does it try to call besides TFactory, as I've seen a few reports that suggest other files downloaded besides that one.
Oh dear the Ukrainians again they dont seem to be stopping do they lots of stuff about with Ukrainian connections at the moment
It dont necessarily have to be Ukrainian / Russian. Its just that they have less tight laws in these regards, so they are often used as hosters. Just like a lot of torrent sites also us the .to TLD.
Commenting by HaloScan
