Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\firefox default browser agent 15003cee9aee9e71
Modifies file system
Creates the following files
- %TEMP%\cc4f.tmp
- %APPDATA%\hbvhuww
Sets the 'hidden' attribute to the following files
- %APPDATA%\hbvhuww
Deletes itself.
Network activity
Connects to
- 'pp##pb.com':80
- 'tw##mel.com':80
TCP
HTTP POST requests
- http://pp##pb.com/upload/
- http://tw##mel.com/upload/
UDP
- DNS ASK pp##pb.com
- DNS ASK tw##mel.com
- DNS ASK ho###cash.com
- DNS ASK la####tasonora.com
- DNS ASK kp###ques.com
Miscellaneous
Creates and executes the following
- '%APPDATA%\hbvhuww'
- '%APPDATA%\hbvhuww' ' (with hidden window)
Executes the following
- '<SYSTEM32>\taskeng.exe' {513A0601-DE88-4A60-9A17-0374FA18E257} S-1-5-21-1960123792-2022915161-3775307078-1001:jxpoyhchtt\user:Interactive:[1]
