Jump to content
Aerosol

Recommended Posts

Aerosol Newbie

Aerosol

Posted
Posted

The virus on VT:

https://www.virustotal.com/en/file/8f35f6f780acccfb406b918db6ef01111dd2c5200a16e97f25d35f76e2532e6d/analysis/1432362743/

The virus inject many process like it:

e1esdt.jpg

but I cann't found how it autostart.

When OS restarted, it start itself via explorer.exe, but I do not know how it auto started.

log:

2015/05/23 15:54:55	c:\windows\explorer.exe	Create new process c:\users\test\appdata\roaming\mozilla\firefox\profiles\4ude5xz7.default\storage\permanent\xulstore.exe?Cmd line: "C:\Users\test\AppData\Roaming\Mozilla\Firefox\Profiles\4ude5xz7.default\storage\permanent\xulstore.exe"

Download

Pass:

infected

Source

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
Go to topic listing
×
×
  • Create New...