Technical Information
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'xploit' = '%APPDATA%\xploit\dropped.exe'
- %APPDATA%\xploit\dropped.exe
- %APPDATA%\xploit\set.bin
- '95.##1.190.199':8980
- http://www.bl####niverse.eu/2/ip.php
- DNS ASK bl####niverse.eu
- '%APPDATA%\xploit\dropped.exe'
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "%APPDATA%\xploit\dropped.exe"