Technical Information
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\openwith.exe
Searches for windows to
detect virtual machines:
- ClassName: 'VBoxTrayToolWndClass', WindowName: ''
- ClassName: '', WindowName: 'VBoxTrayToolWnd'
Modifies file system
Deletes itself.
Network activity
Connects to
- 'mo#####.map.fastly.net':443
- 'cl####lare-dns.com':443
- '18#.#14.96.1':443
TCP
Other
- 'cl####lare-dns.com':443
- '18#.#14.96.1':443
UDP
- DNS ASK mo#####.map.fastly.net
- DNS ASK cl####lare-dns.com
- DNS ASK co##############e-chains.prod.autograph.services.mozaws.net
Miscellaneous
Executes the following
- '<SYSTEM32>\openwith.exe'
