[johnmalfoy112]

can anybody tell what this exe is doing.

jkj.zip

(38.53 KiB) Downloaded 11 times

[EP_X0FF]

It is trojan downloader.

Obfuscated strings from inside.

Code: Select all

"Software\\Microsoft"
"\\Windows\\Currentversion\\Run"
"Taskhst"
"Environment"
"Cq"
"cmd /c start %Cq% "
"&& exit"
"ntuser"
"toolsd.exe"
"aday.primeservices.mobi"
"/IXR/goprim.php"
"Connection: keep-alive"
"Content-type: application/x-www-form-urlencoded"