Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'AppRt3fb6' = '%LOCALAPPDATA%\AppRt3fb6\apprt3fb6.exe'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'AppSvc3fb6' = '%LOCALAPPDATA%\Programs\3fb6\svc3fb6.exe'
Modifies file system
Creates the following files
- nul
- %LOCALAPPDATA%\apprt3fb6\apprt3fb6.exe
- %LOCALAPPDATA%\programs\3fb6\svc3fb6.exe
Network activity
Connects to
- '20#.#94.54.131':6543
Miscellaneous
Creates and executes the following
- '%LOCALAPPDATA%\apprt3fb6\apprt3fb6.exe'
- '%LOCALAPPDATA%\programs\3fb6\svc3fb6.exe'
Executes the following
- '%LOCALAPPDATA%\apprt3fb6\apprt3fb6.exe' ' (with hidden window)
- '%LOCALAPPDATA%\programs\3fb6\svc3fb6.exe' ' (with hidden window)
