Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
Modifies file system
Creates the following files
- %TEMP%\nsxe8ba.tmp
- %TEMP%\kjwc5nfqd37m
- %TEMP%\ooqdyq
- %TEMP%\ynwfjwotp.exe
Network activity
Connects to
- 'ly####.solutions':80
- 'g-###o-62.biz':80
- 'ni#####rfumeonline.com':80
TCP
HTTP GET requests
- http://www.ly####.solutions/tgdh/?2d##########################################################################################
- http://www.g-###o-62.biz/tgdh/?2d##########################################################################################
- http://www.ni#####rfumeonline.com/tgdh/?2d##########################################################################################
UDP
- DNS ASK sj###xj4.xyz
- DNS ASK ly####.solutions
- DNS ASK g-###o-62.biz
- DNS ASK ni#####rfumeonline.com
- DNS ASK de####ineui.site
Miscellaneous
Creates and executes the following
- '%TEMP%\ynwfjwotp.exe' %TEMP%\ooqdyq
Executes the following
- '%WINDIR%\syswow64\svchost.exe'
- '%ProgramFiles(x86)%\mozilla firefox\firefox.exe'
