Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\protecsys
Modifies file system
Creates the following files
- %APPDATA%\systemserviceprovider\serviceclient.exe
- %APPDATA%\presstrak\01-29-2020
Sets the 'hidden' attribute to the following files
- %APPDATA%\systemserviceprovider\serviceclient.exe
Network activity
Connects to
- 'jf####gaeg.ddns.net':5811
- 'se#######ovider.ddnsking.com':5811
- 'se######hinker.myddns.me':5811
- 'localhost':5811
TCP
HTTP GET requests
- http://ip##pi.com/json/
UDP
- DNS ASK ip##pi.com
- DNS ASK jf####gaeg.ddns.net
- DNS ASK se#######ovider.ddnsking.com
- DNS ASK se######hinker.myddns.me
Miscellaneous
Creates and executes the following
- '%APPDATA%\systemserviceprovider\serviceclient.exe'
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "ProtecSys" /sc ONLOGON /tr "<Full path to file>" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "ProtecSys" /sc ONLOGON /tr "%APPDATA%\SystemServiceProvider\ServiceClient.exe" /rl HIGHEST /f
