Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\qtagent_40
- %WINDIR%\tasks\servicehub controller.job
- <SYSTEM32>\tasks\servicehub controller
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\comp.exe
- %WINDIR%\syswow64\explorer.exe
Modifies file system
Creates the following files
- %TEMP%\ce10efb3
- %TEMP%\ceb1aae6
- %APPDATA%\tlsserver\bitb78b.tmp
- %ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\d42cc0c3858a58db2db37658219e6400_0cb67e2f-dc95-45ca-8fb8-69bde8e3f814
- %TEMP%\wymjoewye
Sets the 'hidden' attribute to the following files
- %APPDATA%\tlsserver\bitb78b.tmp
Moves the following files
- from %APPDATA%\tlsserver\bitb78b.tmp to %APPDATA%\tlsserver\qtagent_40.exe
Network activity
Connects to
- 'mo######tral-petparade.com':80
TCP
HTTP POST requests
- http://mo######tral-petparade.com/g9jvjfd73/index.php
UDP
- DNS ASK mo######tral-petparade3.com
- DNS ASK mo######tral-petparade.com
- DNS ASK mo######tral-petparade2.com
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\comp.exe'
- '%WINDIR%\syswow64\explorer.exe'
