Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'RustCrypter' = 'C:/Rust Crypter - INFECTED MACHINE/<File name>.exe'
Modifies file system
Creates the following files
- C:\rust crypter - infected machine\<File name>.exe
Sets the 'hidden' attribute to the following files
- C:\rust crypter - infected machine\<File name>.exe
Network activity
Connects to
- 'po##.#upportxmr.com':443
- 'mo#####.map.fastly.net':443
UDP
- DNS ASK po##.#upportxmr.com
- DNS ASK mo#####.map.fastly.net
- DNS ASK co##############e-chains.prod.autograph.services.mozaws.net
Miscellaneous
Executes the following
- '<SYSTEM32>\attrib.exe' +h "C:/Rust Crypter - INFECTED MACHINE"
- '<SYSTEM32>\attrib.exe' +h "C:/Rust Crypter - INFECTED MACHINE\<File name>.exe"
