Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'ϵͳÉý¼¶Ö§³Ö' = '<Full path to file>\<File name>.exe'
Modifies file system
Creates the following files
- %TEMP%\mz_etilqs_8z68rl8rcnrtbp5
- %TEMP%\mz_etilqs_rjm1yfosnrqtbl6
- %TEMP%\mz_etilqs_rxnbfhhjveq63pz
Sets the 'hidden' attribute to the following files
- <Full path to file>
Network activity
Connects to
- 'jm##z.xyz':14998
- '34.##0.144.191':443
TCP
Other
- 'jm##z.xyz':14998
- '34.##0.144.191':443
UDP
- DNS ASK jm##z.xyz
- DNS ASK fe########alog-cdn.prod.mozaws.net
