Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %WINDIR%\Tasks\{6AD5A78C-4656-D2CD-4AC1-6E77B9D22EB4}.job
Malicious functions:
Creates and executes the following:
- '%APPDATA%\eYRpILTe\ycNwIMtV\TRQuxowc\LTbDTtsFT.exe'
Executes the following:
- '<SYSTEM32>\svchost.exe' -k netsvcs
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system :
Creates the following files:
- %APPDATA%\eYRpILTe\ycNwIMtV\TRQuxowc\LTbDTtsFT.exe
Network activity:
Connects to:
- 'pr###4you.org':80
- 'fi##.#ouwprofs.com':80
- 'ne####temweb.biz':80
UDP:
- DNS ASK pr###4you.org
- DNS ASK fi##.#ouwprofs.com
- DNS ASK ne####temweb.biz
