Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\firefox default browser agent dafe51020652c7e5
Modifies file system
Creates the following files
- %APPDATA%\wfgitaw
Sets the 'hidden' attribute to the following files
- %APPDATA%\wfgitaw
Deletes itself.
Network activity
Connects to
- 'tr####inmyus.com':80
- 'up##ad.ee':443
- 'cd#.##scordapp.com':443
TCP
HTTP POST requests
- http://tr####inmyus.com/index.php
Other
- 'up##ad.ee':443
- 'cd#.##scordapp.com':443
UDP
- DNS ASK tr####inmyus.com
- DNS ASK up##ad.ee
- DNS ASK cd#.##scordapp.com
