Technical Information
Malicious functions
Searches for windows to
detect programs and games:
- ClassName: 'gdkWindowToplevel', WindowName: ''
Modifies file system
Creates the following files
- %TEMP%\systemp.exe
- %TEMP%\u16event.dat
Deletes the following files
- %TEMP%\u16event.dat
- %TEMP%\systemp.exe
Network activity
UDP
- DNS ASK ca###fduty.ee
Miscellaneous
Creates and executes the following
- '%TEMP%\systemp.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c timeout 5 && del %TEMP%\systemp.exe
- '%WINDIR%\syswow64\timeout.exe' 5
- '%WINDIR%\syswow64\cmd.exe' /c timeout 5 && del %TEMP%\systemp.exe' (with hidden window)
