Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\eudcedit.exe
- %WINDIR%\syswow64\pcaui.exe
- %WINDIR%\syswow64\sethc.exe
- %WINDIR%\syswow64\dccw.exe
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\syswow64\eudcedit.exe
- %WINDIR%\syswow64\pcaui.exe
- %WINDIR%\syswow64\sethc.exe
Modifies file system
Creates the following files
- C:\loldsb.ini
- %TEMP%\gospn.log
Deletes the following files
- %TEMP%\gospn.log
Network activity
Connects to
- '22#.#7.96.132':9003
TCP
Other
- '22#.#7.96.132':9003
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\dccw.exe'
- '%WINDIR%\syswow64\cmd.exe' /c echo Y|cacls "<DRIVERS>\etc\hosts" /t /p everyone:f
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo Y"
- '%WINDIR%\syswow64\cacls.exe' "<DRIVERS>\etc\hosts" /t /p everyone:f
- '%WINDIR%\syswow64\cmd.exe' /c echo Y|cacls "<DRIVERS>\etc\hosts" /t /p everyone:f' (with hidden window)
