Technical Information
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\tswbprxy.exe
Modifies file system
Creates the following files
- %WINDIR%\windowsshell4468810.log
- %WINDIR%\windowssystemupdate422.log
Deletes itself.
Network activity
Connects to
- 'su###xxed.asia':36281
- '43.##9.192.68':46282
- '11#.#78.142.200':60123
TCP
Other
- 'su###xxed.asia':36281
- '11#.#78.142.200':60123
UDP
- DNS ASK su###xxed.asia
- '255.255.255.255':58049
Miscellaneous
Executes the following
- '<SYSTEM32>\tswbprxy.exe'
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "<SYSTEM32>\tswbprxy.exe"
- '<SYSTEM32>\cmd.exe' /c del <Full path to file> >> NUL
- '<SYSTEM32>\cmd.exe' /c del <Full path to file> >> NUL' (with hidden window)
