Technical Information
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\cmd.exe
Modifies file system
Creates the following files
- %TEMP%\pcîþïþ¼óè빤¾ß.exe
- %TEMP%\䣿éö§³ö¿â.dll
- %TEMP%\pc.exe
Sets the 'hidden' attribute to the following files
- %TEMP%\pc.exe
Moves the following files
- from %TEMP%\䣿éö§³ö¿â.dll to %TEMP%\1362088\...\temporaryfile
Network activity
UDP
- DNS ASK gi##e.com
- DNS ASK us###.qzone.qq.com
- DNS ASK jq.#q.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'Microsoft Internet Explorer'
Creates and executes the following
- '%TEMP%\pcîþïþ¼óè빤¾ß.exe'
- '%TEMP%\pc.exe'
Executes the following
- '<SYSTEM32>\cmd.exe'
- '%ProgramFiles%\mozilla firefox\firefox.exe' -osint -url "https://jq.qq.com/?_wv=1027&k=5MOrLrN"
