Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\firefox default browser agent ea6d499b031b0312
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
Modifies file system
Creates the following files
- %APPDATA%\dwcvbug
Sets the 'hidden' attribute to the following files
- %APPDATA%\dwcvbug
Deletes itself.
Network activity
Connects to
- 'es##c.at':80
- 'ci##rans.ru':80
- 'mo##o.ru':80
- 'pi###ia-life.ru':80
- 'pi###ia-life.ru':443
TCP
HTTP POST requests
- http://es##c.at/tmp/
- http://ci##rans.ru/tmp/
- http://mo##o.ru/tmp/
- http://pi###ia-life.ru/tmp/
- http://pi##tia.su/tmp/
Other
- 'pi###ia-life.ru':443
UDP
- DNS ASK es##c.at
- DNS ASK re###ust.com
- DNS ASK ci##rans.ru
- DNS ASK ch###elpi.com
- DNS ASK mo##o.ru
- DNS ASK pi###ia-life.ru
- DNS ASK pi##tia.su
Miscellaneous
Creates and executes the following
- '%APPDATA%\dwcvbug'
- '%APPDATA%\dwcvbug' ' (with hidden window)
Executes the following
- '<SYSTEM32>\taskeng.exe' {6685E38B-4775-4995-9569-E16DD0C00C8A} S-1-5-21-1960123792-2022915161-3775307078-1001:tjldslwoy\user:Interactive:[1]
