Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Support Service' = '%TEMP%\\RuntimeBroker.exe'
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\fontdrvhost.exe
Modifies file system
Creates the following files
- %TEMP%\runtimebroker.exe
Network activity
Connects to
- '45.##.66.164':4445
Miscellaneous
Executes the following
- '<SYSTEM32>\fontdrvhost.exe'
- '<SYSTEM32>\cmd.exe'
- '<SYSTEM32>\cmd.exe' ' (with hidden window)
