Technical Information
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\perfmon.exe
Modifies file system
Creates the following files
- conout$
Network activity
Connects to
- 'se####.dbdtools.su':55511
- 'se####.dbdtools.su':51424
TCP
Other
- 'se####.dbdtools.su':55511
- 'se####.dbdtools.su':51424
UDP
- DNS ASK se####.dbdtools.su
- DNS ASK 13#.###.102.62.in-addr.arpa
- DNS ASK 16#.###.#78.172.in-addr.arpa
- DNS ASK 17#.###.#32.199.in-addr.arpa
Miscellaneous
Searches for the following windows
- ClassName: 'WdcWindow' WindowName: ''
- ClassName: 'ConsoleWindowClass' WindowName: ''
Executes the following
- '<SYSTEM32>\perfmon.exe' /res
