Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'pyienwscxh' = '%APPDATA%\pueajsoxhdm\irbwgpl.exe "%TEMP%\clfdtave.exe" %LOCALAPPDATA%�'
Malicious functions
Injects code into
the following user processes:
- clfdtave.exe
Modifies file system
Creates the following files
- %TEMP%\nsre8e8.tmp
- %TEMP%\ayfkgbtlt.b
- %TEMP%\hnuvnlvlzaq.yfm
- %TEMP%\clfdtave.exe
- %APPDATA%\pueajsoxhdm\irbwgpl.exe
Miscellaneous
Creates and executes the following
- '%TEMP%\clfdtave.exe' %TEMP%\hnuvnlvlzaq.yfm
- '%TEMP%\clfdtave.exe'
