Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\raserver
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\cmd.exe
the following user processes:
- rtdcpl64.exe
Modifies file system
Creates the following files
- %APPDATA%\blasthost.exe
- %APPDATA%\imgburn\host.exe
- %APPDATA%\aepic\rtdcpl64.exe
Deletes the following files
- %APPDATA%\imgburn\host.exe
Network activity
UDP
- DNS ASK We#######19.com.strangled.net
- DNS ASK we####.warzonedns.com
- DNS ASK we####yme.ddns.net
Miscellaneous
Creates and executes the following
- '%APPDATA%\blasthost.exe'
- '%APPDATA%\imgburn\host.exe'
- '%APPDATA%\aepic\rtdcpl64.exe'
- '%WINDIR%\syswow64\schtasks.exe' /create /tn raserver /tr "%APPDATA%\aepic\RtDCpl64.exe" /sc minute /mo 1 /F' (with hidden window)
- '%APPDATA%\aepic\rtdcpl64.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe'
- '%WINDIR%\syswow64\schtasks.exe' /create /tn raserver /tr "%APPDATA%\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
- '<SYSTEM32>\taskeng.exe' {8D8EE3B5-C2F8-4FC8-BBA6-128B700BE38F} S-1-5-21-1960123792-2022915161-3775307078-1001:gyphcl\user:Interactive:[1]
