Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\applaunch.exe
Network activity
Connects to
- '18#.#63.204.119':80
- '20#.#89.100.203':80
- '19#.#80.191.234':80
- '18#.#63.204.216':80
- '13#.#62.157.205':80
- 't.#e':443
TCP
HTTP GET requests
- http://13#.#62.157.205/siytetter
Other
- 't.#e':443
UDP
- DNS ASK t.#e
Miscellaneous
Executes the following
- '%WINDIR%\microsoft.net\framework\v4.0.30319\applaunch.exe'
