Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe,"%APPDATA%\Gftqyx\Wgdlak.exe",'
Modifies file system
Creates the following files
- %APPDATA%\gftqyx\wgdlak.exe
Network activity
Connects to
- '19#.#80.49.17':80
- '19#.#80.49.17':28282
- 'ge###ugin.net':80
TCP
HTTP GET requests
- http://19#.#80.49.17/Pruwgxlsz.bmp
- http://ge###ugin.net/json.gp
Other
- '19#.#80.49.17':28282
UDP
- DNS ASK ge###ugin.net
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
