Technical Information
Malicious functions:
Creates and executes the following:
- '%TEMP%\eset\bts.session\{02D83BBE-21EA-0F48-11CF-10CDD92F32F2}\eset_nod32_antivirus_live_installer.exe' --bts-container 2852 "%TEMP%\eset_nod32_antivirus_live_installer.exe"
- '%TEMP%\eset\bts.session\{02D83BBE-21EA-0F48-11CF-10CDD92F32F2}\BootHelper.exe' --watchdog 2900 --product "ESET Live Installer" 11.0.17.0 1033
- '%TEMP%\eset_nod32_antivirus_live_installer.exe'
- '%TEMP%\ESET.exe'
Modifies file system:
Creates the following files:
- %TEMP%\ESET.exe
- %TEMP%\eset_nod32_antivirus_live_installer.exe
Network activity:
Connects to:
- 'go.#set.eu':80
- 'pa###bin.com':443
- 'localhost':1037
TCP:
HTTP POST requests:
- http://go.##et.eu:80/versioncheckxml via go.#set.eu
UDP:
- DNS ASK go.#set.eu
- DNS ASK pa###bin.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
