Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'OverlordAgent-3bc582ad' = '"%APPDATA%\Microsoft\DeviceSync\ovd_5dcbde762352.exe"'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\agent-990163630.tmp
Modifies file system
Creates the following files
- %TEMP%\qtkdlaue.ve4.exe
- %APPDATA%\microsoft\devicesync\agent-75857463.tmp
Moves the following files
- from %APPDATA%\microsoft\devicesync\agent-75857463.tmp to %APPDATA%\microsoft\devicesync\ovd_5dcbde762352.exe
Network activity
Connects to
- '31.##.219.155':5173
TCP
Other
- '31.##.219.155':5173
Miscellaneous
Creates and executes the following
- '%TEMP%\qtkdlaue.ve4.exe'
