Technical Information
Modifies file system
Creates the following files
- %WINDIR%\temp\cab9c00.tmp
- %WINDIR%\temp\tara51c.tmp
- %WINDIR%\temp\caba51b.tmp
- %WINDIR%\temp\tara44f.tmp
- %WINDIR%\temp\caba44e.tmp
- %WINDIR%\temp\tara40f.tmp
- %WINDIR%\temp\caba40e.tmp
- %WINDIR%\temp\tara332.tmp
- %WINDIR%\temp\caba331.tmp
- %WINDIR%\temp\tara2e2.tmp
- %WINDIR%\temp\caba2e1.tmp
- %WINDIR%\temp\tara16a.tmp
- %WINDIR%\temp\caba169.tmp
- %WINDIR%\temp\tara10a.tmp
- %WINDIR%\temp\caba109.tmp
- %WINDIR%\temp\tara02e.tmp
- %WINDIR%\temp\caba02d.tmp
- %WINDIR%\temp\tar9ffd.tmp
- %WINDIR%\temp\cab9ffc.tmp
- %WINDIR%\temp\tar9fbd.tmp
- %WINDIR%\temp\cab9fbc.tmp
- %WINDIR%\temp\tar9f5d.tmp
- %WINDIR%\temp\cab9f5c.tmp
- %WINDIR%\temp\tar9c01.tmp
- %WINDIR%\temp\caba903.tmp
- %WINDIR%\temp\tara904.tmp
Deletes the following files
- %WINDIR%\temp\cab9c00.tmp
- %WINDIR%\temp\tara51c.tmp
- %WINDIR%\temp\caba51b.tmp
- %WINDIR%\temp\tara44f.tmp
- %WINDIR%\temp\caba44e.tmp
- %WINDIR%\temp\tara40f.tmp
- %WINDIR%\temp\caba40e.tmp
- %WINDIR%\temp\tara332.tmp
- %WINDIR%\temp\caba331.tmp
- %WINDIR%\temp\tara2e2.tmp
- %WINDIR%\temp\caba2e1.tmp
- %WINDIR%\temp\tara16a.tmp
- %WINDIR%\temp\caba169.tmp
- %WINDIR%\temp\tara10a.tmp
- %WINDIR%\temp\caba109.tmp
- %WINDIR%\temp\tara02e.tmp
- %WINDIR%\temp\caba02d.tmp
- %WINDIR%\temp\tar9ffd.tmp
- %WINDIR%\temp\cab9ffc.tmp
- %WINDIR%\temp\tar9fbd.tmp
- %WINDIR%\temp\cab9fbc.tmp
- %WINDIR%\temp\tar9f5d.tmp
- %WINDIR%\temp\cab9f5c.tmp
- %WINDIR%\temp\tar9c01.tmp
- %WINDIR%\temp\caba903.tmp
- %WINDIR%\temp\tara904.tmp
Moves itself
- from <Full path to file> to <Current directory>\0vtwc8fxi5mlomuyiwpr.exe
Network activity
Connects to
- 'localhost':49181
- 'localhost':49183
- 'ke##uth.win':443
- 'x1.#.lencr.org':80
- 'x2.#.lencr.org':80
TCP
HTTP GET requests
- http://x1.#.lencr.org/
- http://x2.#.lencr.org/
Other
- 'localhost':49181
- 'localhost':49183
- 'localhost':49184
- 'ke##uth.win':443
UDP
- DNS ASK ke##uth.win
- DNS ASK x1.#.lencr.org
- DNS ASK x2.#.lencr.org
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /c certutil -hashfile "<Full path to file>" MD5 | find /i /v "md5" | find /i /v "certutil"
- '<SYSTEM32>\certutil.exe' -hashfile "<Full path to file>" MD5
- '<SYSTEM32>\find.exe' /i /v "md5"
- '<SYSTEM32>\find.exe' /i /v "certutil"
- '<SYSTEM32>\cmd.exe' /c start cmd /C "color b && title Error && echo SSL connect error && timeout /t 5"
- '<SYSTEM32>\cmd.exe' /C "color b && title Error && echo SSL connect error && timeout /t 5"
- '<SYSTEM32>\timeout.exe' /t 5
