Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] '6k1Dc9YvF' = '%APPDATA%\AGEGE\dJdbu7l70_87qXu9zL7\6k1Dc9YvF.exe'
Modifies file system
Creates the following files
- %APPDATA%\agege\djdbu7l70_87qxu9zl7\6k1dc9yvf.txt
- %APPDATA%\agege\djdbu7l70_87qxu9zl7\6k1dc9yvf.exe
- %WINDIR%\fleetmissionutils.dll
- %WINDIR%\mywatch.dll
- %LOCALAPPDATA%\1fcbfbff000406f1
- %APPDATA%\agege\djdbu7l70_87qxu9zl7\.lnk
Deletes following files that it created itself
- %APPDATA%\agege\djdbu7l70_87qxu9zl7\.lnk
Network activity
Connects to
- '23.##6.57.28':8080
- '23.##6.57.28':12345
TCP
HTTP GET requests
- http://23.###.57.28:8080/10x.dll via 23.##6.57.28
Other
- '23.##6.57.28':12345
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%APPDATA%\agege\djdbu7l70_87qxu9zl7\6k1dc9yvf.exe'
Restarts the analyzed sample
Executes the following
- '<Full path to file>' 46053F055905500576056005770576055905700576056005770559054405750575054105640571056405590557056A05640568056C056B056205590544054205400542054005590561054F0561056705700532056905320535055A053D0532057...' (with hidden window)
