Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\pcclubnetservice
Modifies file system
Creates the following files
- %APPDATA%\pcclubagent\agent.exe
Network activity
Connects to
- 'ri#########ote-administration.hf.space':443
TCP
Other
- 'ri#########ote-administration.hf.space':443
UDP
- DNS ASK ri#########ote-administration.hf.space
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /C schtasks /create /tn "PCClubNetService" /tr "%APPDATA%\PCClubAgent\agent.exe" /sc onlogon /rl limited /f
- '<SYSTEM32>\schtasks.exe' /create /tn "PCClubNetService" /tr "%APPDATA%\PCClubAgent\agent.exe" /sc onlogon /rl limited /f
- '<SYSTEM32>\cmd.exe' /C schtasks /query /tn "PCClubNetService"
- '<SYSTEM32>\schtasks.exe' /query /tn "PCClubNetService"
- '<SYSTEM32>\cmd.exe' /C schtasks /create /tn "PCClubNetService" /tr "%APPDATA%\PCClubAgent\agent.exe" /sc onlogon /rl limited /f' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C schtasks /query /tn "PCClubNetService"' (with hidden window)
