Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\Windows.js
Malicious functions:
Injects code into
the following user processes:
- <File name>.exe
Modifies file system:
Creates the following files:
- %APPDATA%\<File name>.exe
- %APPDATA%\qqqqq\logs.dat
Sets the 'hidden' attribute to the following files:
- %APPDATA%\qqqqq\logs.dat
Network activity:
Connects to:
- 'sk#.#epis.faith':2486
- 're####t.tortbro.men':2483
UDP:
- DNS ASK sk#.#epis.faith
- DNS ASK re####t.tortbro.men
Miscellaneous:
Creates and executes the following:
- '%APPDATA%\<File name>.exe'
