Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\firefox default browser agent 543ec01959f15d23
Modifies file system
Creates the following files
- %APPDATA%\ewdfwwt
Sets the 'hidden' attribute to the following files
- %APPDATA%\ewdfwwt
Deletes itself.
Network activity
Connects to
- 'ci##ms.club':443
- 'ye.#.lencr.org':80
- 'cl###es.surf':443
- 'x1.#.lencr.org':80
TCP
HTTP GET requests
- http://x1.#.lencr.org/
Other
- 'ci##ms.club':443
- 'cl###es.surf':443
UDP
- DNS ASK ci##ms.club
- DNS ASK ye.#.lencr.org
- DNS ASK cl###es.surf
- DNS ASK x1.#.lencr.org
