Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\firefox default browser agent 04fd43dfc54cdcce
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
Modifies file system
Creates the following files
- %TEMP%\cc4f.tmp
- %APPDATA%\cvsedjb
Sets the 'hidden' attribute to the following files
- %APPDATA%\cvsedjb
Deletes the following files
- %TEMP%\cc4f.tmp
Substitutes the following files
- %TEMP%\cc4f.tmp
Deletes itself.
Network activity
Connects to
- 'pp##pb.com':80
- 'tw##mel.com':80
TCP
HTTP POST requests
- http://pp##pb.com/upload/
- http://tw##mel.com/upload/
UDP
- DNS ASK pp##pb.com
- DNS ASK tw##mel.com
- DNS ASK ho###cash.com
- DNS ASK la####tasonora.com
- DNS ASK kp###ques.com
Miscellaneous
Creates and executes the following
- '%APPDATA%\cvsedjb'
- '%APPDATA%\cvsedjb' ' (with hidden window)
Executes the following
- '<SYSTEM32>\taskeng.exe' {6BD20AEF-96D1-4C6A-81D5-6713620819D2} S-1-5-21-1960123792-2022915161-3775307078-1001:farwejw\user:Interactive:[1]
