Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\cmd.exe' /K del /q /s /f "%HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles" & rd /s /q "%HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles" & exit
- '<SYSTEM32>\cmd.exe' /K del "%HOMEPATH%\AppData\Roaming\Mozilla\Firefox\profiles.ini" & exit
- '<SYSTEM32>\cmd.exe' /K del /q /s /f "%HOMEPATH%\AppData\Local\Google\Chrome\User Data" & rd /s /q "%HOMEPATH%\AppData\Local\Google\Chrome\User Data" & exit
- '<SYSTEM32>\cmd.exe' /K del /q /s /f "%HOMEPATH%\AppData\Local\Microsoft\Intern~1" & rd /s /q "%HOMEPATH%\AppData\Local\Microsoft\Intern~1"
- '<SYSTEM32>\cmd.exe' /K del /q /s /f "%HOMEPATH%\AppData\Local\Microsoft\Windows\Tempor~1" & rd /s /q "%HOMEPATH%\AppData\Local\Microsoft\Windows\Tempor~1"
- '<SYSTEM32>\cmd.exe' /K del /q /s /f "%HOMEPATH%\AppData\Roaming\Microsoft\Windows\Cookies" & rd /s /q "%HOMEPATH%\AppData\Roaming\Microsoft\Windows\Cookies"
Terminates or attempts to terminate
the following user processes:
- chrome.exe
- firefox.exe
- iexplore.exe
Network activity:
Connects to:
- 'tl########.web21.redehost.com.br':80
TCP:
HTTP POST requests:
- http://tl########.web21.redehost.com.br/novo/verifica.php
UDP:
- DNS ASK tl########.web21.redehost.com.br
Miscellaneous:
Modifies value of AutoConfigURL parameter to 'http://petelgesso.com/zerado/acabo.vai'
Searches for the following windows:
- ClassName: 'MS_WINHELP' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
