Technical Information
To ensure autorun and distribution
Creates or modifies the following files
Malicious functions
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Modifies file system
Creates the following files
- %APPDATA%\microsoft\windows\start menu\programs\file\file.exe
Network activity
Connects to
- 'cd#.##scordapp.com':443
- 'ch####p.dyndns.org':80
TCP
HTTP GET requests
- http://ch####p.dyndns.org/
Other
- 'cd#.##scordapp.com':443
UDP
- DNS ASK cd#.##scordapp.com
- DNS ASK ch####p.dyndns.org
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
