Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'tarjsdefy' = 'regsvr32.exe /s "%LOCALAPPDATA%\ApplicationHistory\tarjsdefy.dll"'
Malicious functions
Injects code into
the following user processes:
- msinfo32.exe
Modifies file system
Creates the following files
- %LOCALAPPDATA%\applicationhistory\tarjsdefy.dll
Network activity
Connects to
- '10#.#06.180.132':80
TCP
HTTP GET requests
- http://10#.#06.180.132/en-us/3L+y8u/q8u/wuO6l84nkppPw7+zo8O7l7fA=
Miscellaneous
Executes the following
- '%CommonProgramFiles(x86)%\microsoft shared\msinfo\msinfo32.exe'
