Technical Information
Malicious functions
Creates and executes the following (exploit)
- '%PROGRAMDATA%\arinzeh4927.com'
Injects code into
the following user processes:
- arinedf.exe
Modifies file system
Creates the following files
- %PROGRAMDATA%\arinzeh4927.com
- %APPDATA%\arindhf\arinedf.exe
- %APPDATA%\arindhf\arinedf.exe:zoneidentifier
Network activity
TCP
HTTP GET requests
- http://uz###sse.top/arinze/arinze.exe
UDP
- DNS ASK uz###sse.top
Miscellaneous
Creates and executes the following
- '%APPDATA%\arindhf\arinedf.exe'
Executes the following
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
- '%WINDIR%\microsoft.net\framework\v2.0.50727\dw20.exe' -x -s 468
