Technical Information
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%TEMP%\AnyDesk.exe' = '%TEMP%\AnyDesk.exe:*:Enabled:AnyDesk'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%TEMP%\AnyDesk.exe' = '%TEMP%\AnyDesk.exe:*:Enabled:AnyDesk'
Modifies file system:
Creates the following files:
- %TEMP%\nsd2.tmp
- %TEMP%\powershell.exe
- %TEMP%\AnyDesk.exe
- %APPDATA%\AnyDesk\ad.trace
- %APPDATA%\AnyDesk\user.conf
- %APPDATA%\AnyDesk\service.conf
- %APPDATA%\AnyDesk\system.conf
Network activity:
Connects to:
- 'bo#####.net.anydesk.com':443
- '78.#6.49.23':443
- 'bo#####.net.anydesk.com':80
- '78.#6.49.23':80
- 'wp#d':80
- '85.##.103.30':443
- '85.##.103.30':80
TCP:
HTTP GET requests:
- http://11#.#11.111.2/wpad.dat via wp#d
UDP:
- DNS ASK bo#####.net.anydesk.com
- DNS ASK wp#d
Miscellaneous:
Creates and executes the following:
- '%TEMP%\powershell.exe'
- '%TEMP%\AnyDesk.exe'
- '%TEMP%\AnyDesk.exe' --local-service
- '%TEMP%\AnyDesk.exe' --local-control
