Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\sysnetsvc.exe
Modifies file system
Creates the following files
- %TEMP%\csrss_svc.exe
Network activity
Connects to
- 'google.com':443
- '16#.#2.10.116':80
- '16#.#2.10.116':3333
TCP
Other
- 'google.com':443
UDP
- DNS ASK google.com
Miscellaneous
Creates and executes the following
- '%TEMP%\csrss_svc.exe'
Executes the following
- '%TEMP%\csrss_svc.exe' ' (with hidden window)
