Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
the following user processes:
- firefox.exe
Modifies file system
Creates the following files
- %TEMP%\nsudb.tmp
- %TEMP%\otopwf.x
- %TEMP%\nsz149.tmp\qnnviwz.dll
Deletes itself.
Network activity
Connects to
- 'sc###thny.com':80
TCP
HTTP GET requests
- http://www.sc###thny.com/k13s/?DL##################################################################################
UDP
- DNS ASK sc###thny.com
Miscellaneous
Restarts the analyzed sample
Executes the following
- '%WINDIR%\syswow64\raserver.exe'
- '%WINDIR%\syswow64\cmd.exe' del "<Full path to file>"
