Technical Information
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\cmd.exe
Modifies file system
Creates the following files
- <Current directory>\i4qnhz0gko0lgo.7z
- <Current directory>\cmuyu9p.exe
Deletes itself.
Network activity
Connects to
- '<DNS_SERVER>':443
- '18#.#14.97.1':443
- '18#.#14.96.1':443
TCP
Other
- '<DNS_SERVER>':443
- '18#.#14.97.1':443
- '18#.#14.96.1':443
Miscellaneous
Creates and executes the following
- '<Current directory>\cmuyu9p.exe'
Executes the following
- '<SYSTEM32>\cmd.exe'
