Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Classes\discord-1281827199447732295\shell\open\command] '' = '<Full path to file>'
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /im HTTPDebuggerUI.exe
- '<SYSTEM32>\taskkill.exe' /f /im Fiddler.exe
Modifies file system
Creates the following files
- nul
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'IDA: Quick start'
- ClassName: '' WindowName: 'Memory Viewer'
- ClassName: '' WindowName: 'Process List'
- ClassName: '' WindowName: 'KsDumper'
- ClassName: '' WindowName: 'HTTP Debugger'
- ClassName: '' WindowName: 'OllyDbg'
- ClassName: '' WindowName: ''
Executes the following
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im Fiddler.exe >nul 2>&1
