Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\systemhost.url
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /F /PID 1192
Modifies file system
Creates the following files
- %HOMEPATH%\documents\iisexpress\bypass\interpeter.exe
Network activity
TCP
- 'rq#.#lsdmake.ru':443
UDP
- DNS ASK rq#.#lsdmake.ru
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%HOMEPATH%\documents\iisexpress\bypass\interpeter.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C taskkill /F /PID 1192 && choice /C Y /N /D Y /T 3 & Del "<Full path to file>"
- '%WINDIR%\syswow64\choice.exe' /C Y /N /D Y /T 3
