Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'b60f676c47a75df6cf29a815d4f04731' = '"%TEMP%\alougt.exe" ..'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'b60f676c47a75df6cf29a815d4f04731' = '"%TEMP%\alougt.exe" ..'
Malicious functions
Executes the following
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "%TEMP%\alougt.exe" "alougt.exe" ENABLE
Modifies file system
Creates the following files
- %TEMP%\alougt.exe
Network activity
Connects to
- 'xx###.ddns.net':7502
TCP
- 'h.###4top.io':443
UDP
- DNS ASK h.###4top.io
- DNS ASK xx###.ddns.net
Miscellaneous
Creates and executes the following
- '%TEMP%\alougt.exe'
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "%TEMP%\alougt.exe" "alougt.exe" ENABLE' (with hidden window)
