Technical Information
- %APPDATA%\microsoft\windows\start menu\programs\firefox.exe
- <File name>.exe
- %TEMP%\rcjahgjzonjkdf.vbs
- %TEMP%\<File name>.exe
- 'cd#.##scordapp.com':443
- '18#.#40.53.178':1515
- 'cd#.##scordapp.com':443
- DNS ASK cd#.##scordapp.com
- DNS ASK de######dlambo9.ddns.net
- '%WINDIR%\syswow64\wscript.exe' "%TEMP%\Rcjahgjzonjkdf.vbs"
- '%TEMP%\<File name>.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Set-MpPreference -ExclusionPath C:\,'%APPDATA%\Microsoft\Windows\Start Menu\Programs\firefox.exe'' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Set-MpPreference -ExclusionPath C:\,'%APPDATA%\Microsoft\Windows\Start Menu\Programs\firefox.exe'