Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\cmd.exe' /c rd "<DRIVERS>\etcAB1MQ" /S /Q
Modifies file system:
Deletes the following files:
- <DRIVERS>\etc\hosts
Substitutes the HOSTS file.
Network activity:
Connects to:
- 'pt#.#hdlq.com':80
- '8.#.8.8':80
- 'c.##dlq.com':80
- 'a.##dlq.com':80
- 'b.##dlq.com':80
TCP:
HTTP GET requests:
- http://c.##dlq.com/Remote.txt
- http://pT#.#hdlq.com/Remote.txt via pt#.#hdlq.com
- http://a.##dlq.com/Remote.txt
- http://b.##dlq.com/Remote.txt
UDP:
- DNS ASK c.##dlq.com
- DNS ASK pT#.#hdlq.com
- DNS ASK a.##dlq.com
- DNS ASK b.##dlq.com
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: 'GINA Logon'
