Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
the following user processes:
- iexplore.exe
Hooks functions
in browsers
- firefox.exe process, nss3.dll module
Network activity
Connects to
- 'cd#.##scordapp.com':443
TCP
Other
- 'cd#.##scordapp.com':443
UDP
- DNS ASK cd#.##scordapp.com
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\logagent.exe'
- '%WINDIR%\syswow64\wlanext.exe'
- '%WINDIR%\syswow64\cmd.exe' del "%WINDIR%\SysWOW64\logagent.exe"
