Technical Information
Modifies file system
Moves the following system files
- from %WINDIR%\microsoft.net\framework\v4.0.30319\msbuild.exe to %APPDATA%\e6f983\35a09b.exe
Network activity
Connects to
- '19#.#33.18.171':80
TCP
HTTP GET requests
- http://19#.#33.18.171/Bmtwirdj_Fuigalcn.jpg
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c timeout 20' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c timeout 20
- '%WINDIR%\syswow64\timeout.exe' 20
- '%WINDIR%\microsoft.net\framework\v4.0.30319\msbuild.exe'
