Technical Information
Malicious functions
Injects code into
the following user processes:
- jyrpw.exe
Modifies file system
Creates the following files
- %TEMP%\ft.exe
- %TEMP%\jyrpw.exe
Network activity
Connects to
- 'do####ad.scdn.co':443
- 'do####ad.scdn.co':80
TCP
HTTP GET requests
- http://do####ad.scdn.co/SpotifyFullSetup.exe
Other
- 'do####ad.scdn.co':443
UDP
- DNS ASK do####ad.scdn.co
Miscellaneous
Creates and executes the following
- '%TEMP%\ft.exe'
- '%TEMP%\jyrpw.exe'
