Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\msbuild.exe
Modifies file system
Creates the following files
- %TEMP%\c81129f2
- %ALLUSERSPROFILE%\fortect\tcpvcon.exe
- %TEMP%\c93ed28a
- %TEMP%\ibucekq
Network activity
TCP
Other
- '34.##9.100.209':443
UDP
- DNS ASK 19#.###.160.34.in-addr.arpa
- DNS ASK 20#.###.149.34.in-addr.arpa
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\fortect\tcpvcon.exe' "%ALLUSERSPROFILE%\Fortect\tcpvcon.exe" /accepteula
Executes the following
- '%WINDIR%\microsoft.net\framework\v4.0.30319\msbuild.exe'
