Technical Information
Malicious functions
Injects code into
the following user processes:
- iexplore.exe
- firefox.exe
Hooks functions
in browsers
- firefox.exe process, nss3.dll module
- firefox.exe process, mswsock.dll module
Modifies file system
Creates the following files
- %TEMP%\getx64btit.exe
- %TEMP%\x64btit.txt
Deletes the following files
- %TEMP%\x64btit.txt
- %TEMP%\getx64btit.exe
Network activity
Connects to
- '19#.#8.81.140':80
- '19#.#09.206.212':80
- '66.##1.2.131':9030
- 'ap#.#pify.org':443
- '20#.#3.164.118':80
TCP
Other
- 'ap#.#pify.org':443
UDP
- DNS ASK ap#.#pify.org
Miscellaneous
Creates and executes the following
- '%TEMP%\getx64btit.exe'
