Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsUpdateTask' = '"<Full path to file>"'
Malicious functions
Launches a large number of processes
Network activity
Connects to
- '5.###.248.26':80
TCP
HTTP POST requests
Miscellaneous
Restarts the analyzed sample
Executes the following
- '<Full path to file>' --agent 4424' (with hidden window)
- '<Full path to file>' ' (with hidden window)
- '<Full path to file>' --agent 2868' (with hidden window)
- '<Full path to file>' --agent 3944' (with hidden window)
- '<Full path to file>' --agent 3940' (with hidden window)
- '<Full path to file>' --agent 3000' (with hidden window)
- '<Full path to file>' --agent 3900' (with hidden window)
- '<Full path to file>' --agent 668' (with hidden window)
- '<Full path to file>' --agent 2068' (with hidden window)
- '<Full path to file>' --agent 4632' (with hidden window)
- '<Full path to file>' --agent 3912' (with hidden window)
- '<Full path to file>' --agent 888' (with hidden window)
- '<Full path to file>' --agent 3312' (with hidden window)
- '<Full path to file>' --agent 68' (with hidden window)
- '<Full path to file>' --agent 4496' (with hidden window)
- '<Full path to file>' --agent 4088' (with hidden window)
- '<Full path to file>' --agent 4016' (with hidden window)
- '<Full path to file>' --agent 5024' (with hidden window)
- '<Full path to file>' --agent 5060' (with hidden window)
- '<Full path to file>' --agent 5000' (with hidden window)
- '<Full path to file>' --agent 4552' (with hidden window)
- '<Full path to file>' --agent 3384' (with hidden window)
- '<Full path to file>' --agent 2844' (with hidden window)
- '<Full path to file>' --agent 2324' (with hidden window)
- '<Full path to file>' --agent 4600' (with hidden window)
- '<Full path to file>' --agent 3304' (with hidden window)
- '<Full path to file>' --agent 2240' (with hidden window)
- '<Full path to file>' --agent 3564' (with hidden window)
- '<Full path to file>' --agent 4132' (with hidden window)
- '<Full path to file>' --agent 2848' (with hidden window)
- '<Full path to file>' --agent 2488' (with hidden window)
- '<Full path to file>' --agent 628' (with hidden window)
- '<Full path to file>' --agent 4956' (with hidden window)
- '<Full path to file>' --agent 5032' (with hidden window)
- '<Full path to file>' --agent 3180' (with hidden window)
- '<Full path to file>' --agent 2916' (with hidden window)
- '<Full path to file>' --agent 3760' (with hidden window)
- '<Full path to file>' --agent 3892' (with hidden window)
- '<Full path to file>' --agent 2036' (with hidden window)
- '<Full path to file>' --agent 2632' (with hidden window)
- '<Full path to file>' --agent 3056' (with hidden window)
- '<Full path to file>' --agent 1784' (with hidden window)
- '<Full path to file>' --agent 2904' (with hidden window)
- '<Full path to file>' --agent 3236' (with hidden window)
- '<Full path to file>' --agent 3732' (with hidden window)
- '<Full path to file>' --agent 2468' (with hidden window)
- '<Full path to file>' --agent 1256' (with hidden window)
- '<Full path to file>' --agent 4440' (with hidden window)
- '<Full path to file>' --agent 2348' (with hidden window)
- '<Full path to file>' --agent 3464' (with hidden window)
- '<Full path to file>' --agent 1952' (with hidden window)
- '<Full path to file>' --agent 4024' (with hidden window)
- '<Full path to file>' --agent 676' (with hidden window)
- '<Full path to file>' --agent 720' (with hidden window)
- '<Full path to file>' --agent 1596' (with hidden window)
- '<Full path to file>' --agent 3960' (with hidden window)
- '<Full path to file>' --agent 3876' (with hidden window)
- '<Full path to file>' --agent 3776' (with hidden window)
- '<Full path to file>' --agent 3332' (with hidden window)
- '<Full path to file>' --agent 3888' (with hidden window)
- '<Full path to file>' --agent 3708' (with hidden window)
- '<Full path to file>' --agent 3584' (with hidden window)
- '<Full path to file>' --agent 3152' (with hidden window)
- '<Full path to file>' --agent 4976' (with hidden window)
- '<Full path to file>' --agent 1580' (with hidden window)
- '<Full path to file>' --agent 5104' (with hidden window)
- '<Full path to file>' --agent 2012' (with hidden window)
- '<Full path to file>' --agent 2936' (with hidden window)
- '<Full path to file>' --agent 4648' (with hidden window)
- '<Full path to file>' --agent 3320' (with hidden window)
- '<Full path to file>' --agent 2716' (with hidden window)
- '<Full path to file>' --agent 3872' (with hidden window)
- '<Full path to file>' --agent 2272' (with hidden window)
- '<Full path to file>' --agent 4340' (with hidden window)
- '<Full path to file>' --agent 1928' (with hidden window)
- '<Full path to file>' --agent 3396' (with hidden window)
- '<Full path to file>' --agent 4148' (with hidden window)
- '<Full path to file>' --agent 4408' (with hidden window)
- '<Full path to file>' --agent 4960' (with hidden window)
- '<Full path to file>' --agent 4020' (with hidden window)
- '<Full path to file>' --agent 920' (with hidden window)
- '<Full path to file>' --agent 2612' (with hidden window)
- '<Full path to file>' --agent 4784' (with hidden window)
- '<Full path to file>' --agent 2720' (with hidden window)
