Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\XTMPPVAQFQQe.lnk
Malicious functions:
Executes the following:
- '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'
- '%APPDATA%\QQXc.exe' "%APPDATA%\QQXcP"
Injects code into
the following system processes:
- <SYSTEM32>\cmd.exe
a large number of user processes.
Modifies file system:
Creates the following files:
- %APPDATA%\QQXc.exe
- %APPDATA%\QQXcP
- %APPDATA%\Monitor\Screenshots\12-15-2016\7.03 PM
- <Current directory>\QQXcP
- %TEMP%\aut1.tmp
- <Current directory>\QQXc.exe
- %TEMP%\aut2.tmp
Sets the 'hidden' attribute to the following files:
- %HOMEPATH%\SU7jRuWpPImzpiKf\QQXcP
- %HOMEPATH%\SU7jRuWpPImzpiKf\QQXc.exe
Deletes the following files:
- %TEMP%\aut2.tmp
- %TEMP%\aut1.tmp
Moves the following files:
- from %APPDATA%\QQXc.exe to %HOMEPATH%\SU7jRuWpPImzpiKf\QQXc.exe
- from %APPDATA%\QQXcP to %HOMEPATH%\SU7jRuWpPImzpiKf\QQXcP
Network activity:
Connects to:
- 'ca####1122.ddns.net':29715
UDP:
- DNS ASK ca####1122.ddns.net
