Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'CD15AA9A' = '%APPDATA%\CD15AA9A\CD15AA9A.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'CD15AA9A' = '%APPDATA%\CD15AA9A\CD15AA9A.exe'
- %HOMEPATH%\Start Menu\Programs\Startup\CD15AA9A.exe
- %APPDATA%\CD15AA9A\CD15AA9A.exe
- <SYSTEM32>\ctfmon.exe
- <SYSTEM32>\alg.exe
- <SYSTEM32>\cscript.exe
- <SYSTEM32>\smss.exe
- %WINDIR%\Explorer.EXE
- <SYSTEM32>\spoolsv.exe
- %APPDATA%\CD15AA9A\CD15AA9A.exe
- '75##6f68.kz':80
- 75##6f68.kz/imagedump/image.php?si#########################################
- DNS ASK 75##6f68.kz
- '<Private IP address>':1035
- ClassName: 'Indicator' WindowName: ''