Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\firefox default browser agent f0aab12e6f2e28d3
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
Modifies file system
Creates the following files
- %APPDATA%\ujdufgu
Sets the 'hidden' attribute to the following files
- %APPDATA%\ujdufgu
Deletes itself.
Network activity
Connects to
- 'mo###tiur4.com':80
TCP
HTTP POST requests
- http://mo###tiur4.com/
UDP
- DNS ASK mo###tiur4.com
Miscellaneous
Creates and executes the following
- '%APPDATA%\ujdufgu'
Executes the following
- '<SYSTEM32>\taskeng.exe' {832FA9D4-6A76-475F-8420-C52042610834} S-1-5-21-3691498038-2086406363-2140527554-1000:depnbdwodkh\user:Interactive:[1]
- '%APPDATA%\ujdufgu' ' (with hidden window)
