Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%TEMP%\Chrom.exe" "Chrom.exe" ENABLE
Modifies file system
Creates the following files
- %TEMP%\3.exe
- %TEMP%\dbbdqmfwsaa6h9k.jpg
- %TEMP%\chrom.exe
Network activity
Connects to
- 'localhost':5552
Miscellaneous
Creates and executes the following
- '%TEMP%\3.exe'
- '%TEMP%\chrom.exe'
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%TEMP%\Chrom.exe" "Chrom.exe" ENABLE' (with hidden window)
