Technical Information
Modifies file system
Creates the following files
- %HOMEPATH%\documents\m7lknjh5swma\qxf12qqcotoe84ym4angl2vs.exe
- %TEMP%\7zipsfx.000\due.aspx
- %TEMP%\7zipsfx.000\bonta.aspx
- %TEMP%\$inst\2.tmp
- %HOMEPATH%\documents\geh79n1bzeyn\jmdq1ahyp4ajivnpxksb5sxl.exe
- %HOMEPATH%\documents\37l2aop79wcl\2ipuflxnvesqc1f3uu8120m7.exe
- %HOMEPATH%\documents\s65qtrhrsrd0\g7jg4rwilol0xcpqly6j1pes.exe
- %HOMEPATH%\documents\qhczuklxrq88\mloxozn4ki5yodmjibejbct9.exe
- %TEMP%\7zipsfx.000\era.aspx
- %HOMEPATH%\documents\ppxceejofcza\rozagvwpquephqqgcvuyvim6.exe
- %HOMEPATH%\documents\7mgrbz8vfa9b\sm1pzrkkrcyringy1kgb4gdq.exe
- %HOMEPATH%\documents\6q9gbmos46ys\dkaaq0p2jmorjtlytxgh0kd6.exe
- %HOMEPATH%\documents\2mrnezbnu9wk\ddpb2idxphcgojodku3ls2wn.exe
- %HOMEPATH%\documents\wwgglo6f23i5\mcfskpvd6xkvf2qrfgqc9t23.exe
- %HOMEPATH%\documents\fxtxpfzkmic4\4t2csx77jnids3gg3wtcafah.exe
- %HOMEPATH%\documents\oc3lctzaozar\ybyesrhylx6jxok1wruvvuea.exe
- %HOMEPATH%\documents\xppi8a0hx5tu\uhmoitrzsvo08do1gtc57gsp.exe
- %HOMEPATH%\documents\jfb5wox3hdhd\8ac2meah43pg0hqqnbbvtkf4.exe
- %TEMP%\7zipsfx.000\mite.aspx
Deletes the following files
- %TEMP%\$inst\2.tmp
Network activity
Connects to
- '21#.#92.241.136':80
- 'le###esp.info':443
- 'cd#.##scordapp.com':443
- '2n#.co':443
- 'ip###ger.org':443
- 'fe###appen.com':80
- 'd.###dgame.live':443
- 'microsoft.com':80
TCP
HTTP GET requests
- http://21#.#92.241.136/files/file2.exe
- http://21#.#92.241.136/files/file9.exe
- http://21#.#92.241.136/files/file5.exe
- http://21#.#92.241.136/files/file7.exe
- http://21#.#92.241.136/files/file4.exe
- http://21#.#92.241.136/files/file1.exe
- http://21#.#92.241.136/files/file6.exe
- http://21#.#92.241.136/files/file8.exe
- http://fe###appen.com/magnus/ebook.exe
- http://ww.###kacademy.me/
Other
- 'le###esp.info':443
- '2n#.co':443
- 'cd#.##scordapp.com':443
- 'jo#.##regame.live':443
- 'd.###dgame.live':443
UDP
- DNS ASK ww.###kacademy.me
- DNS ASK lo#.##ckacademy.me
- DNS ASK le###esp.info
- DNS ASK cd#.##scordapp.com
- DNS ASK pr####ytools.xyz
- DNS ASK jo#.##regame.live
- DNS ASK mo#####mediacompany.com
- DNS ASK 2n#.co
- DNS ASK ip###ger.org
- DNS ASK fe###appen.com
- DNS ASK d.###dgame.live
- DNS ASK microsoft.com
- DNS ASK wa###435fc.com
Miscellaneous
Creates and executes the following
- '%HOMEPATH%\documents\fxtxpfzkmic4\4t2csx77jnids3gg3wtcafah.exe'
- '%HOMEPATH%\documents\2mrnezbnu9wk\ddpb2idxphcgojodku3ls2wn.exe'
- '%HOMEPATH%\documents\geh79n1bzeyn\jmdq1ahyp4ajivnpxksb5sxl.exe'
- '%HOMEPATH%\documents\s65qtrhrsrd0\g7jg4rwilol0xcpqly6j1pes.exe'
- '%HOMEPATH%\documents\37l2aop79wcl\2ipuflxnvesqc1f3uu8120m7.exe'
- '%HOMEPATH%\documents\m7lknjh5swma\qxf12qqcotoe84ym4angl2vs.exe'
- '%HOMEPATH%\documents\7mgrbz8vfa9b\sm1pzrkkrcyringy1kgb4gdq.exe'
- '%HOMEPATH%\documents\qhczuklxrq88\mloxozn4ki5yodmjibejbct9.exe'
- '%HOMEPATH%\documents\wwgglo6f23i5\mcfskpvd6xkvf2qrfgqc9t23.exe'
- '%HOMEPATH%\documents\oc3lctzaozar\ybyesrhylx6jxok1wruvvuea.exe'
- '%HOMEPATH%\documents\jfb5wox3hdhd\8ac2meah43pg0hqqnbbvtkf4.exe'
- '%HOMEPATH%\documents\6q9gbmos46ys\dkaaq0p2jmorjtlytxgh0kd6.exe'
- '%HOMEPATH%\documents\xppi8a0hx5tu\uhmoitrzsvo08do1gtc57gsp.exe'
- '%HOMEPATH%\documents\ppxceejofcza\rozagvwpquephqqgcvuyvim6.exe'
- '%ProgramFiles(x86)%\company\newproduct\jooyu.exe' ' (with hidden window)
- '%ProgramFiles(x86)%\company\newproduct\file4.exe' ' (with hidden window)
- '%ProgramFiles(x86)%\company\newproduct\md8_8eus.exe' ' (with hidden window)
- '%ProgramFiles(x86)%\company\newproduct\jingzhang.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c <SYSTEM32>\cmd < Era.aspx' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c <SYSTEM32>\cmd < Era.aspx
