Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\pj3hz
Modifies file system
Creates the following files
- %HOMEPATH%\documents\d8y0ar.exe
- %HOMEPATH%\documents\vselog.dll
- %HOMEPATH%\documents\wordpadfilter.db
- %HOMEPATH%\documents\msmplist.dat
- <DRIVERS>\189atohci.sys
Sets the 'hidden' attribute to the following files
- %HOMEPATH%\documents\d8y0ar.exe
- %HOMEPATH%\documents\vselog.dll
- %HOMEPATH%\documents\wordpadfilter.db
- %HOMEPATH%\documents\msmplist.dat
Network activity
Connects to
- 'vi####.###-cn-beijing.aliyuncs.com':443
TCP
Other
- 'vi####.###-cn-beijing.aliyuncs.com':443
UDP
- DNS ASK vi####.###-cn-beijing.aliyuncs.com
Miscellaneous
Creates and executes the following
- '%HOMEPATH%\documents\d8y0ar.exe'
Executes the following
- '<SYSTEM32>\taskeng.exe' {2690F7C6-D959-43A3-AD16-24ED312DFD93} S-1-5-21-3691498038-2086406363-2140527554-1000:fxufcd\user:Interactive:[1]
- '%HOMEPATH%\documents\d8y0ar.exe' ' (with hidden window)
