Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\desde.vbs
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework64\v4.0.30319\installutil.exe
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\microsoft.net\framework64\v4.0.30319\installutil.exe
Modifies file system
Creates the following files
- %TEMP%\content\428-1284-<File name>.exe-01-43-44-920.dump
- %TEMP%\content\428-1284-<File name>.exe-01-43-45-406.dump
- %TEMP%\content\428-1284-<File name>.exe-01-43-45-421.dump
- %TEMP%\11223.exe
- %TEMP%\content\2612-1564-11223.exe-01-43-47-412.dump
- %TEMP%\content\2612-1564-11223.exe-01-43-47-885.dump
- %TEMP%\content\2612-1564-11223.exe-01-43-47-898.dump
- %APPDATA%\desde.exe
Network activity
UDP
- DNS ASK cl####lare-dns.com
Miscellaneous
Creates and executes the following
- '%TEMP%\11223.exe'
Executes the following
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\installutil.exe'
