Technical Information
Malicious functions:
Executes the following:
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe'
Injects code into
the following system processes:
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe
Modifies file system:
Creates the following files:
- C:\Temp\KDG\Kingdomcheck1395914441.txt
Deletes the following files:
- C:\Temp\KDG\Kingdomcheck1395914441.txt
Network activity:
Connects to:
- 're####7.blogspot.kr':80
TCP:
HTTP GET requests:
- http://re####7.blogspot.kr/2017/04/070416.html
UDP:
- DNS ASK re####7.blogspot.kr
Miscellaneous:
Searches for the following windows:
- ClassName: '#32771' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'AutoHotkey' WindowName: '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe'
