Technical Information
Malicious functions:
Injects code into
the following user processes:
- winhost (2).exe
Modifies file system:
Creates the following files:
- %APPDATA%\1337\winhost (2).exe
- %TEMP%\is-1U29F.tmp\vpn.tmp
- %APPDATA%\1337\vpn.exe
- %TEMP%\nsf2.tmp
- %TEMP%\nsa3.tmp\System.dll
Deletes the following files:
- %TEMP%\nsa3.tmp\System.dll
Miscellaneous:
Creates and executes the following:
- '%TEMP%\is-1U29F.tmp\vpn.tmp' /SL5="$40092,7490130,150528,%APPDATA%\1337\vpn.exe"
- '%APPDATA%\1337\winhost (2).exe'
- '%APPDATA%\1337\vpn.exe'
