Technical Information
Modifies file system
Creates the following files
- %TEMP%\<File name>.exepack.tmp
- %TEMP%\83d988cc5bb36e840830b4f0c7a8a3b2.dat
- %TEMP%\83d988cc5bb36e840830b4f0c7a8a3b2.ini
- %TEMP%\83d988cc5bb36e840830b4f0c7a8a3b2a.ini
- %TEMP%\ГґВГЄВјГЁГЁГ±ВЄ[k-8].exepack.tmp
- <Current directory>\ГґВГЄВјГЁГЁГ±ВЄ[k-8].exe
- C:\ГґВê¼¶à ¼ò[d-6].lnk
- %TEMP%\63fcab7babeed48aad871618a3193e09.dat
- <Current directory>\data\newopui.pak
- <Current directory>\wav\sound.lst
- <Current directory>\data\mapdesc3.dat
- <Current directory>\data\mapdesc2.dat
- <Current directory>\data\esp-b.dat
- <Current directory>\data\bbzdywb.txt
- %TEMP%\²¹¶¡.zip
- %TEMP%\3cc37e.txt
- %TEMP%\63fcab7babeed48aad871618a3193e09.ini
- %TEMP%\63fcab7babeed48aad871618a3193e09a.ini
- C:\ГґВГЄВјГЁГЁГ±ВЄ[k-8].lnk
- %LOCALAPPDATA%\microsoft\internet explorer\msimgsiz.dat
Deletes the following files
- %TEMP%\63fcab7babeed48aad871618a3193e09.ini
- %TEMP%\²¹¶¡.zip
- %HOMEPATH%\desktop\ГґВê¼¶à ¼ò[d-6].lnk
- %TEMP%\83d988cc5bb36e840830b4f0c7a8a3b2.ini
Moves the following files
- from C:\ГґВê¼¶à ¼ò[d-6].lnk to %HOMEPATH%\desktop\ГґВê¼¶à ¼ò[d-6].lnk
- from C:\ГґВГЄВјГЁГЁГ±ВЄ[k-8].lnk to %HOMEPATH%\desktop\ГґВГЄВјГЁГЁГ±ВЄ[k-8].lnk
Substitutes the following files
- %TEMP%\²¹¶¡.zip
Deletes itself.
Network activity
Connects to
- 'ht##q.com':80
- 'a.##sf.com':7000
- '10#.#0.164.224':5888
- 'ww###.yx5y.com':80
- 'ys#.#2ahd.top':8390
- '51##.com':80
- '51##.com':443
- 'oc##.#ectigo.com':80
TCP
HTTP GET requests
- http://www.ht##q.com/bmd.txt
- http://10#.##.164.224:5888/02-40/rxysa/ysa6.txt via 10#.#0.164.224
- http://ww###.yx5y.com/02-40/ysrxabgx/ФКјИИСЄ[K-8].exe
- http://ys#.##ahd.top:8390/link.asp via ys#.#2ahd.top
- http://ys#.##ahd.top:8390/link/images/new_sp.png via ys#.#2ahd.top
- http://ys#.##ahd.top:8390/link/images/link01_bg.jpg via ys#.#2ahd.top
- http://10#.##.164.224:5888/02-40/rxysa/ysa8.txt via 10#.#0.164.224
- http://ys#.##ahd.top:8390/link.asp
- http://ys#.##ahd.top:8390/link/images/new_sp.png
- http://ys#.##ahd.top:8390/link/images/new_a.png
- http://www.51##.com/d.php?id#######
- http://ys#.##ahd.top:8390/link/images/link01_bg.jpg
- http://oc##.#ectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEQCJRy1Cj4oiz9O0fuMnWkAp
- http://www.51##.com/d.php?id#############
Other
- 'a.##sf.com':7000
- '51##.com':443
UDP
- DNS ASK ht##q.com
- DNS ASK a.##sf.com
- DNS ASK ww###.yx5y.com
- DNS ASK ys#.#2ahd.top
- DNS ASK 51##.com
- DNS ASK oc##.#ectigo.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '<Current directory>\ГґВГЄВјГЁГЁГ±ВЄ[k-8].exe' "<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /c del "<Current directory>\*.dll"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del "<Current directory>\*tatv.exe"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c del "<Current directory>\*tatv.exe"
- '%WINDIR%\syswow64\cmd.exe' /c del "<Current directory>\*.dll"
