Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'rbwgpktpyie' = '%APPDATA%\rwsclgpyuea\jsoxhdmi.exe "%TEMP%\ccdyg.exe" %LOCALAPPDATA%\T�'
Malicious functions
Injects code into
the following user processes:
- ccdyg.exe
Modifies file system
Creates the following files
- %TEMP%\nstfdc0.tmp
- %TEMP%\novgyb.g
- %TEMP%\nrxgki.ev
- %TEMP%\ccdyg.exe
- %APPDATA%\rwsclgpyuea\jsoxhdmi.exe
Miscellaneous
Creates and executes the following
- '%TEMP%\ccdyg.exe' %TEMP%\nrxgki.ev
- '%TEMP%\ccdyg.exe'
