Technical Information
Malicious functions
Injects code into
the following user processes:
- windefender.exe
Modifies file system
Creates the following files
- %TEMP%\ñìýøì.exe
- %TEMP%\windefender.exe
- %TEMP%\chro.dat
- %TEMP%\ffox.dat
- %TEMP%\opra.dat
Deletes the following files
- %TEMP%\chro.dat
- %TEMP%\ffox.dat
- %TEMP%\opra.dat
Network activity
Connects to
- 'bl###shades.ru':8080
UDP
- DNS ASK bl###shades.ru
Miscellaneous
Creates and executes the following
- '%TEMP%\ñìýøì.exe'
- '%TEMP%\windefender.exe'
- '%TEMP%\windefender.exe' /stext "%TEMP%\chro.dat"
- '%TEMP%\windefender.exe' /stext "%TEMP%\iexp.dat"
- '%TEMP%\windefender.exe' /stext "%TEMP%\ffox.dat"
- '%TEMP%\windefender.exe' /stext "%TEMP%\opra.dat"
