Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\firefox default browser agent 7fac25d0bd918da2
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
Modifies file system
Creates the following files
- %APPDATA%\desbsgg
Sets the 'hidden' attribute to the following files
- %APPDATA%\desbsgg
Deletes itself.
Network activity
Connects to
- 'ca####andhalls.com':443
- 'be####rldhools.com':443
TCP
Other
- 'ca####andhalls.com':443
UDP
- DNS ASK ca####andhalls.com
- DNS ASK be####rldhools.com
Miscellaneous
Creates and executes the following
- '%APPDATA%\desbsgg'
Executes the following
- '<SYSTEM32>\taskeng.exe' {BC6BD615-8CB2-452C-A8F7-319ACC0BAAD8} S-1-5-21-3691498038-2086406363-2140527554-1000:nkakquca\user:Interactive:[1]
- '%APPDATA%\desbsgg' ' (with hidden window)
