Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\firefox default browser agent 83fd4db81730220a
Modifies file system
Creates the following files
- %APPDATA%\efbrcbc
Sets the 'hidden' attribute to the following files
- %APPDATA%\efbrcbc
Deletes itself.
Network activity
Connects to
- 'ta##i.at':80
- 'gr###grad.ru':80
- 'gr###grad.ru':443
- 'pk#.goog':80
- 'ki###irate.ru':80
- 'ki###irate.ru':443
TCP
HTTP GET requests
- http://pk#.goog/gsr1/gsr1.crt
HTTP POST requests
- http://ta##i.at/tmp/
- http://gr###grad.ru/tmp/
- http://ki###irate.ru/tmp/
Other
- 'gr###grad.ru':443
- 'ki###irate.ru':443
UDP
- DNS ASK ta##i.at
- DNS ASK 01##roy.ru
- DNS ASK ma##net.com
- DNS ASK gr###grad.ru
- DNS ASK pk#.goog
- DNS ASK ki###irate.ru
