Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %WINDIR%\tasks\pe.dll
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\rundll32.exe' %WINDIR%\Tasks\pe.dll, DllRegisterServer
Network activity
Connects to
- '13#.#8.229.0':80
- 'de##ord.com':443
TCP
HTTP GET requests
- http://13#.#8.229.0/pe.dll
Other
- 'de##ord.com':443
UDP
- DNS ASK de##ord.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\rundll32.exe' %WINDIR%\Tasks\pe.dll, DllRegisterServer' (with hidden window)
