Technical Information
Malicious functions:
Creates and executes the following:
- '' (downloaded from the Internet)
Modifies file system:
Creates the following files:
- %TEMP%\cat.exe
Network activity:
Connects to:
- 'al####ress103.tk':80
- 'localhost':1040
- 'in#####.rgbcjfir.com':80
TCP:
HTTP GET requests:
- http://al####ress103.tk/click.php?cn######
- http://in#####.rgbcjfir.com/download/APSFMarketatorPix2
UDP:
- DNS ASK al####ress103.tk
- DNS ASK in#####.rgbcjfir.com
Miscellaneous:
Creates and executes the following:
- '%TEMP%\cat.exe' {"packer":{"DistributerName":"APSFMarketatorPix2","ChannelId":"724"},"Agent":{"SetAll":"true","pid":"724","sid":"001"}}
