Technical Information
Malicious functions
Injects code into
the following user processes:
- adelrcp.exe
Modifies file system
Creates the following files
- <Current directory>\yljekyfkezqindf.data
- <Current directory>\ahubnrnrguivgij.data
Deletes the following files
- <Current directory>\yljekyfkezqindf.data
- <Current directory>\ahubnrnrguivgij.data
Network activity
Connects to
- 'ta##tool.pw':80
TCP
HTTP POST requests
- http://ta##tool.pw/api
UDP
- DNS ASK ta##tool.pw
Miscellaneous
Executes the following
- '%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adelrcp.exe'
