The virus starts by decryipting a part of its code in order to resolve its imports.

When that is done it searches for the process svchost.exe, injects in it and creates the mutex asd..6567fj.

After the virus code has been injected it checks if it runs from C:RecyclerD-1-5-21-1482476501-1644491937-682003330-1013autorun.exe and if doesn’t it copies to that location. It then creates two threads.

For more information, symptoms and removal instructions click here .

About the author


The meaning of Bitdefender’s mascot, the Dacian Draco, an ancient symbol that depicts a mythical animal with a wolf’s head and a dragon’s body, is “to watch” and to “guard with a sharp eye.” Like our mascot, we are committed to using Bitdefender Labs, our world-class research team, to vigilantly find and eradicate threats for our customers, and to use our platform for the larger good.