Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
Modifies file system
Creates the following files
- <Current directory>\msedge.exe
- nul
Network activity
UDP
- DNS ASK ul########srqhunaggp.supabase.co
Miscellaneous
Creates and executes the following
- '<Current directory>\msedge.exe' --randomized
Executes the following
- '<SYSTEM32>\cmd.exe' /c ping localhost -n 2 > nul & del /f /q "<Full path to file>"
- '<SYSTEM32>\ping.exe' localhost -n 2
- '<SYSTEM32>\cmd.exe' /c ping localhost -n 2 > nul & del /f /q "<Full path to file>"' (with hidden window)
