Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\applaunch.exe
Modifies file system
Creates the following files
- %TEMP%\7aff11cd-79fe-4cfd-9290-f5f3b5745a0c\agiledotnetrt.dll
Network activity
TCP
HTTP GET requests
- http://s7#####604.online.de/%7B%5D%5D()%7B)%5D%7D()%7D()(%7B(%7B%5D)%7B%7B)((%7B%5D%5D()%7B)%5D%7D()%7D()(%7B(%7B%5D)%7B%7B)(%5D)%7B(%7D%5D%5D()%7B)%5D%7D(%7B)%5D%7D()%7D%5D)%7B%7B)(%5D)%7B(%7D...
UDP
- DNS ASK bing.com
- DNS ASK s7#####604.online.de
Miscellaneous
Executes the following
- '%WINDIR%\microsoft.net\framework\v4.0.30319\applaunch.exe'
