Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'slfcenv1' = 'C:\slpcenv\slfcenv1.exe'
Modifies file system
Creates the following files
- C:\slpcenv\slfcimsi\slfcenv1.exe
- C:\slpcenv\slfcimsi\slfcenv2.exe
- C:\slpcenv\slfcimsi\slwinmaint.exe
- %TEMP%\nskc391.tmp\nsisdl.dll
- C:\slpcenv\slfcenv1.exe
- C:\slpcenv\slfcenv2.exe
- %WINDIR%\inciterinstaller
- %TEMP%\nsq6b2b.tmp\system.dll
- C:\slpcenv\slfcver\slfcenv2_err.txt
- C:\slpcenv\slfclog\sl-2020-02-13.log
- %TEMP%\nsq6b2b.tmp\nsisdl.dll
Deletes the following files
- %TEMP%\nskc391.tmp\nsisdl.dll
Network activity
Connects to
- '10#.#54.81.100':80
Miscellaneous
Creates and executes the following
- 'C:\slpcenv\slfcimsi\slfcenv2.exe'
