Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /F /IM ADT_Launcher.exe
Modifies file system
Creates the following files
- <Current directory>\_adt_launcher.exe
Moves the following files
- from <Current directory>\_adt_launcher.exe to <Current directory>\adt_launcher.exe
Network activity
Connects to
- 'ap#.##t-team.com':80
TCP
HTTP GET requests
- http://ad###eam.com/api.php?ac####################
- http://ad###eam.com/launcher/repository/launcher/ADT_Launcher.exe
UDP
- DNS ASK ap#.##t-team.com
- DNS ASK ad###eam.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c cd <Current directory>\ & taskkill /F /IM ADT_Launcher.exe & del /f ADT_Launcher.exe & ren _ADT_Launcher.exe ADT_Launcher.exe' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c cd <Current directory>\ & taskkill /F /IM ADT_Launcher.exe & del /f ADT_Launcher.exe & ren _ADT_Launcher.exe ADT_Launcher.exe
