Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'AppRteddd' = '%LOCALAPPDATA%\AppRteddd\apprteddd.exe'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'AppSvceddd' = '%LOCALAPPDATA%\Programs\eddd\svceddd.exe'
Modifies file system
Creates the following files
- nul
- %LOCALAPPDATA%\apprteddd\apprteddd.exe
- %LOCALAPPDATA%\programs\eddd\svceddd.exe
Network activity
Connects to
- '20#.#94.54.131':6543
Miscellaneous
Creates and executes the following
- '%LOCALAPPDATA%\apprteddd\apprteddd.exe'
- '%LOCALAPPDATA%\programs\eddd\svceddd.exe'
Executes the following
- '%LOCALAPPDATA%\apprteddd\apprteddd.exe' ' (with hidden window)
- '%LOCALAPPDATA%\programs\eddd\svceddd.exe' ' (with hidden window)
