Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'DH7XN6X0GXL' = '%ProgramFiles(x86)%\Mj4-tcda8\rlhdutzx.exe'
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
Hooks functions
in browsers
- iexplore.exe process, wininet.dll module
- firefox.exe process, nss3.dll module
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\syswow64\autofmt.exe
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\000814251_video_01.avi
Modifies file system
Creates the following files
- %TEMP%\mj4-tcda8\rlhdutzx.exe
- %ProgramFiles(x86)%\mj4-tcda8\rlhdutzx.exe
- %APPDATA%\6qm6naqe\6qmlogri.ini
Deletes itself.
Network activity
TCP
HTTP GET requests
- http://www.fa#####flaremusic.com/f90/?ch################################################################################################
UDP
- DNS ASK fa#####flaremusic.com
Miscellaneous
Creates and executes the following
- '%ProgramFiles(x86)%\mj4-tcda8\rlhdutzx.exe'
Executes the following
- '%WINDIR%\syswow64\systray.exe'
- '%WINDIR%\syswow64\cmd.exe' del "<Full path to file>"
- '%ProgramFiles(x86)%\mozilla firefox\firefox.exe'
