Technical Information
Malicious functions:
Creates and executes the following:
- '<SYSTEM32>\cfile27.exe'
- '<SYSTEM32>\cfile27.exe' (downloaded from the Internet)
Executes the following:
- '<SYSTEM32>\rundll32.exe' dfdts.dll,DfdGetDefaultPolicyAndSMART
Modifies file system :
Creates the following files:
- <SYSTEM32>\cfile27.exe
- %TEMP%\nsxDE0F.tmp\NSISdl.dll
Deletes the following files:
- %TEMP%\nsxDE0F.tmp\NSISdl.dll
Network activity:
Connects to:
- 'www.qn###stks.com':80
TCP:
HTTP GET requests:
- www.qn###stks.com/cfile27.exe
UDP:
- DNS ASK www.qn###stks.com
