Technical Information
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\winver.exe
Modifies file system
Moves itself
- from <Full path to file> to \:wtfbbq
Network activity
Connects to
- 'hk##########z.oss-cn-hongkong.aliyuncs.com':443
- '54.#6.93.43':6605
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?12##############
Other
- 'hk##########z.oss-cn-hongkong.aliyuncs.com':443
- '54.#6.93.43':6605
UDP
- DNS ASK hk##########z.oss-cn-hongkong.aliyuncs.com
Miscellaneous
Executes the following
- '<SYSTEM32>\winver.exe'
- '<SYSTEM32>\winver.exe' ' (with hidden window)
