Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\firefox default browser agent edb9aaa5fe632fd1
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
the following user processes:
- wthbwui
Modifies file system
Creates the following files
- %APPDATA%\wthbwui
Sets the 'hidden' attribute to the following files
- %APPDATA%\wthbwui
Deletes itself.
Network activity
Connects to
- 'ho#####ta-coin-11.com':80
TCP
HTTP POST requests
- http://ho#####ta-coin-11.com/
UDP
- DNS ASK ho#####ta-coin-11.com
Miscellaneous
Creates and executes the following
- '%APPDATA%\wthbwui'
Restarts the analyzed sample
