Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'RFLDEOEEE' = '%LOCALAPPDATA%\RFLDEOEEE\RFLDEOEEEKUO.vbs'
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\regsvr32.exe
Modifies file system
Creates the following files
- %TEMP%\sxy.bmp
- %TEMP%\sxylsr.exe
- %TEMP%\sxy.txt
- %HOMEPATH%\contacts\rfldeoeeeseo.exe
- %HOMEPATH%\desktop_a\rfldeoeee.bmp
- %LOCALAPPDATA%\rfldeoeee\rfldeoeeenko.bat
- %LOCALAPPDATA%\rfldeoeee\rfldeoeeekuo.vbs
- %APPDATA%\kkdkd\logs.dat
Deletes the following files
- %TEMP%\sxy.txt
Network activity
Connects to
- '17#.#24.140.144':2030
Miscellaneous
Creates and executes the following
- '%TEMP%\sxylsr.exe'
- '%TEMP%\sxylsr.exe' ' (with hidden window)
Executes the following
- '<SYSTEM32>\regsvr32.exe'
