Creamsicle
Description
(FireEye) CREAMSICLE attempts to download an encoded executable from a specified location.
The downloaded file is decoded, written to disk as %APPDATA%\Norton360\Engine\5.1.0.29\ccSvcHst.exe, and padded with 51,200,000 null bytes. CREAMSICLE does not appear to execute the downloaded file, presumably relying on Windows to do so (using the shortcut file in the user’s Startup folder) the next time the user logs in.
Names
| Name |
|---|
| Creamsicle |
Category
Malware
Type
- Downloader
Information
Malpedia
Alienvault Otx
Other Information
Uuid
ec3678b0-7ffb-4b53-ae26-cfbd54dfc3df
Last Card Change
2020-04-23