Technical Information
Malicious functions:
Creates and executes the following:
- '%TEMP%\pr.exe'
- '%TEMP%\rewq.exe' http://dd##.ddns.net/pr.exe
- '%TEMP%\pr.exe' (downloaded from the Internet)
Executes the following:
- '<SYSTEM32>\find.exe' /i "rewq.exe"
- '<SYSTEM32>\taskkill.exe' /im "praetorian.exe"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\install.cmd" "
- '<SYSTEM32>\tasklist.exe'
Modifies file system :
Creates the following files:
- %TEMP%\pr.exe
- %TEMP%\rewq.exe
- %TEMP%\install.cmd
Deletes the following files:
- <DRIVERS>\etc\hosts
Substitutes the HOSTS file.
Network activity:
Connects to:
- 'dd##.ddns.net':80
TCP:
HTTP GET requests:
- dd##.ddns.net/pr.exe
UDP:
- DNS ASK dd##.ddns.net
Miscellaneous:
Searches for the following windows:
- ClassName: '(null)' WindowName: '(null)'
