Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe,"%LOCALAPPDATA%\Detrimantor\experto.exe",'
Malicious functions
Injects code into
the following user processes:
- <File name>.exe
Modifies file system
Creates the following files
- %LOCALAPPDATA%\detrimantor\experto.exe
- %TEMP%\<File name>.exe
- %LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\<File name>.exe.log
Network activity
Connects to
- 'co##oso.com':80
TCP
HTTP POST requests
- http://www.co##oso.com/PostAccepter.aspx
UDP
- DNS ASK co##oso.com
- DNS ASK tr#####edia555.ddns.net
Miscellaneous
Creates and executes the following
- '%TEMP%\<File name>.exe'
