Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\StartMeUp.lnk
Malicious functions:
Executes the following:
- '<SYSTEM32>\ping.exe' 1.1.1.1 -n 1 -w 15000
Modifies file system :
Creates the following files:
- %ALLUSERSPROFILE%\Application Data\Microsoft\Windows\Explorer\CRNJEUFU-%USERNAME%\crnjeufu-StartMeUp.exe
Network activity:
Connects to:
- '14#.#48.49.10':80
- 'go###e.com.br':80
TCP:
HTTP GET requests:
- 14#.#48.49.10/Cliente1/LiberaWork.aspx?id#########################
UDP:
- DNS ASK go###e.com.br
