Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'OPHEDER' = '%TEMP%\Zinkhvidts4\Flovet.exe'
Malicious functions
Injects code into
the following user processes:
- ieinstal.exe
Modifies file system
Creates the following files
- %TEMP%\zinkhvidts4\flovet.exe
Network activity
Connects to
- '37.#.10.149':80
Miscellaneous
Executes the following
- '%ProgramFiles(x86)%\internet explorer\ieinstal.exe'
