Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] '4871467F6C6BB2BA' = '%ALLUSERSPROFILE%\Client Demo\saser.exe'
Creates or modifies the following files
- <SYSTEM32>\tasks\client demo
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\client demo\saser.exe
- nul
Network activity
Connects to
- '38.##.227.64':80
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\client demo\saser.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /C timeout /t 3 /nobreak > Nul & Del /f /q "<Full path to file>"
- '<SYSTEM32>\timeout.exe' /t 3 /nobreak
