Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'AppRt932c' = '%LOCALAPPDATA%\AppRt932c\apprt932c.exe'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'AppSvc932c' = '%LOCALAPPDATA%\Programs\932c\svc932c.exe'
Modifies file system
Creates the following files
- nul
- %LOCALAPPDATA%\apprt932c\apprt932c.exe
- %LOCALAPPDATA%\programs\932c\svc932c.exe
Network activity
Connects to
- '20#.#94.54.131':6543
Miscellaneous
Creates and executes the following
- '%LOCALAPPDATA%\apprt932c\apprt932c.exe'
- '%LOCALAPPDATA%\programs\932c\svc932c.exe'
Executes the following
- '%LOCALAPPDATA%\apprt932c\apprt932c.exe' ' (with hidden window)
- '%LOCALAPPDATA%\programs\932c\svc932c.exe' ' (with hidden window)
