Technical Information
Malicious functions:
Creates and executes the following:
- '%APPDATA%\RegConf.exe'
- '%APPDATA%\winsnrnr.exe'
- '%APPDATA%\RegConf.exe' (downloaded from the Internet)
Executes the following:
- '<SYSTEM32>\schtasks.exe' /create /sc onlogon /f /tn winspot /rl highest /tr "%APPDATA%\winsnrnr.exe"
- '<SYSTEM32>\cmd.exe' /c ""%APPDATA%\strtpbtfile.bat" "
Terminates or attempts to terminate
the following user processes:
- chrome.exe
Modifies file system:
Creates the following files:
- %APPDATA%\RegConf.exe
- %APPDATA%\strtpbtfile.bat
- %APPDATA%\winsnrnr.exe
Sets the 'hidden' attribute to the following files:
- %APPDATA%\strtpbtfile.bat
- %APPDATA%\winsnrnr.exe
Network activity:
Connects to:
- 'ba####demaix.com':80
- 'localhost':1038
TCP:
HTTP GET requests:
- http://ba####demaix.com/update.exe
UDP:
- DNS ASK ba####demaix.com
