Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\firefox default browser agent 5710df7344ae5601
Modifies file system
Creates the following files
- %APPDATA%\giuthat
Sets the 'hidden' attribute to the following files
- %APPDATA%\giuthat
Deletes itself.
Network activity
Connects to
- 'ci##ms.club':443
- 'ye.#.lencr.org':80
- 'x2.#.lencr.org':80
- 'x1.#.lencr.org':80
- 'cl###es.surf':443
TCP
HTTP GET requests
- http://ye.#.lencr.org/
- http://x1.#.lencr.org/
Other
- 'ci##ms.club':443
- 'cl###es.surf':443
UDP
- DNS ASK ci##ms.club
- DNS ASK ye.#.lencr.org
- DNS ASK x2.#.lencr.org
- DNS ASK x1.#.lencr.org
- DNS ASK cl###es.surf
