Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
the following user processes:
- jjj.exe
Searches for windows to
detect programs and games:
- ClassName: 'gdkWindowToplevel', WindowName: ''
Modifies file system
Creates the following files
- %TEMP%\hhhhhhh.exe
- %TEMP%\jjj.exe
- %TEMP%\u16event.dat
- %APPDATA%\addons.dat
Deletes the following files
- %TEMP%\u16event.dat
- %TEMP%\hhhhhhh.exe
Network activity
TCP
- 'ft#.#rivehq.com':21
UDP
- DNS ASK ft#.#rivehq.com
Miscellaneous
Creates and executes the following
- '%TEMP%\hhhhhhh.exe'
- '%TEMP%\jjj.exe'
- '%WINDIR%\syswow64\cmd.exe' /c timeout 5 && del %TEMP%\hhhhhhh.exe' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c timeout 5 && del %TEMP%\hhhhhhh.exe
- '%WINDIR%\syswow64\timeout.exe' 5
