Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\mscuivedeoire.lnk
Malicious functions
Injects code into
the following user processes:
- addinprocess32.exe
Modifies file system
Creates the following files
- %TEMP%\addinprocess32.exe
- %APPDATA%\mscuivedeoire.exe
- %TEMP%\estaccynow.txt
- %TEMP%\estaccynow.exe
- %APPDATA%\36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee\run.dat
Network activity
Connects to
- '18#.#57.162.81':40700
Miscellaneous
Creates and executes the following
- '%APPDATA%\mscuivedeoire.exe'
- '%TEMP%\addinprocess32.exe'
- '%TEMP%\estaccynow.exe'
