Technical Information
Modifies file system
Creates the following files
- %WINDIR%\temp\cab7c31.tmp
- %WINDIR%\temp\tar4bc.tmp
- %WINDIR%\temp\cab4bb.tmp
- %WINDIR%\temp\tareeda.tmp
- %WINDIR%\temp\cabeed9.tmp
- %WINDIR%\temp\taree3c.tmp
- %WINDIR%\temp\cabee3b.tmp
- %WINDIR%\temp\tard84a.tmp
- %WINDIR%\temp\cabd849.tmp
- %WINDIR%\temp\tard7ea.tmp
- %WINDIR%\temp\cabd7e9.tmp
- %WINDIR%\temp\tarc1c9.tmp
- %WINDIR%\temp\cabc1c8.tmp
- %WINDIR%\temp\tarc179.tmp
- %WINDIR%\temp\cabc169.tmp
- %WINDIR%\temp\tarab39.tmp
- %WINDIR%\temp\cabab38.tmp
- %WINDIR%\temp\taraada.tmp
- %WINDIR%\temp\cabaad9.tmp
- %WINDIR%\temp\taraa7a.tmp
- %WINDIR%\temp\cabaa79.tmp
- %WINDIR%\temp\tara9ec.tmp
- %WINDIR%\temp\caba9eb.tmp
- %WINDIR%\temp\tar939c.tmp
- %WINDIR%\temp\cab938c.tmp
- %WINDIR%\temp\tar932d.tmp
- %WINDIR%\temp\cab932c.tmp
- %WINDIR%\temp\tar7c32.tmp
- %WINDIR%\temp\cab47c5.tmp
- %WINDIR%\temp\tar47c6.tmp
Deletes the following files
- %WINDIR%\temp\cab7c31.tmp
- %WINDIR%\temp\tar4bc.tmp
- %WINDIR%\temp\cab4bb.tmp
- %WINDIR%\temp\tareeda.tmp
- %WINDIR%\temp\cabeed9.tmp
- %WINDIR%\temp\taree3c.tmp
- %WINDIR%\temp\cabee3b.tmp
- %WINDIR%\temp\tard84a.tmp
- %WINDIR%\temp\cabd849.tmp
- %WINDIR%\temp\tard7ea.tmp
- %WINDIR%\temp\cabd7e9.tmp
- %WINDIR%\temp\tarc1c9.tmp
- %WINDIR%\temp\cabc1c8.tmp
- %WINDIR%\temp\tarc179.tmp
- %WINDIR%\temp\cabc169.tmp
- %WINDIR%\temp\tarab39.tmp
- %WINDIR%\temp\cabab38.tmp
- %WINDIR%\temp\taraada.tmp
- %WINDIR%\temp\cabaad9.tmp
- %WINDIR%\temp\taraa7a.tmp
- %WINDIR%\temp\cabaa79.tmp
- %WINDIR%\temp\tara9ec.tmp
- %WINDIR%\temp\caba9eb.tmp
- %WINDIR%\temp\tar939c.tmp
- %WINDIR%\temp\cab938c.tmp
- %WINDIR%\temp\tar932d.tmp
- %WINDIR%\temp\cab932c.tmp
- %WINDIR%\temp\tar7c32.tmp
- %WINDIR%\temp\cab47c5.tmp
- %WINDIR%\temp\tar47c6.tmp
Moves itself
- from <Full path to file> to <Current directory>\7f8l6n3aolz.exe
Network activity
Connects to
- 'localhost':49186
- 'localhost':49188
- 'ke##uth.win':443
- 'x1.#.lencr.org':80
- 'x2.#.lencr.org':80
TCP
HTTP GET requests
- http://x1.#.lencr.org/
- http://x2.#.lencr.org/
Other
- 'localhost':49186
- 'localhost':49188
- 'localhost':49189
- 'ke##uth.win':443
UDP
- DNS ASK ke##uth.win
- DNS ASK x1.#.lencr.org
- DNS ASK x2.#.lencr.org
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /c certutil -hashfile "<Full path to file>" MD5 | find /i /v "md5" | find /i /v "certutil"
- '<SYSTEM32>\certutil.exe' -hashfile "<Full path to file>" MD5
- '<SYSTEM32>\find.exe' /i /v "md5"
- '<SYSTEM32>\find.exe' /i /v "certutil"
