Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %WINDIR%\csrss.exe
- %TEMP%\message.zip
Network activity
Connects to
- '85.##9.23.35':80
- '20#.#6.250.119':80
- '84.##.161.192':80
Miscellaneous
Searches for the following windows
- ClassName: 'TMsgEditor' WindowName: ''
- ClassName: 'ATH_Note' WindowName: ''
Creates and executes the following
- '%WINDIR%\csrss.exe'
- '%WINDIR%\csrss.exe' ' (with hidden window)
- '%WINDIR%\syswow64\svchost.exe' %WINDIR%\csrss.exe' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\svchost.exe' %WINDIR%\csrss.exe
