Technical Information
Malicious functions:
Creates and executes the following:
- '' (downloaded from the Internet)
Modifies file system:
Creates the following files:
- %TEMP%\aut1.tmp
- %TEMP%\scqpxln
- %TEMP%\aut2.tmp
- %HOMEPATH%\AppData\Roaming\Audio\CONFIG\configCPU1.json
- %TEMP%\aut3.tmp
- %HOMEPATH%\AppData\Roaming\Audio\CONFIG\configCPU.json
- %TEMP%\aut4.tmp
- %HOMEPATH%\AppData\Roaming\Audio\CONFIG\configAMD.json
- %TEMP%\aut5.tmp
- %HOMEPATH%\AppData\Roaming\Audio\CONFIG\configCUDA.json
- %HOMEPATH%\AppData\Roaming\Audio\codec.exe
- %HOMEPATH%\AppData\Roaming\Audio\AudioHD.exe
- %HOMEPATH%\AppData\Roaming\Audio\taskhost.exe
Sets the 'hidden' attribute to the following files:
- %HOMEPATH%\AppData\Roaming\Audio\AudioHD.exe
- %HOMEPATH%\AppData\Roaming\Audio\codec.exe
- %HOMEPATH%\AppData\Roaming\Audio\taskhost.exe
Deletes the following files:
- %TEMP%\aut1.tmp
- %TEMP%\scqpxln
- %TEMP%\aut2.tmp
- %TEMP%\aut3.tmp
- %TEMP%\aut4.tmp
- %TEMP%\aut5.tmp
Network activity:
Connects to:
- 'vi####us84.had.su':80
TCP:
HTTP GET requests:
- http://vi####us84.had.su/stream.exe
- http://vi####us84.had.su/codec.exe
- http://vi####us84.had.su/AudioHD.exe
- http://vi####us84.had.su/taskhost.exe
UDP:
- DNS ASK vi####us84.had.su
Miscellaneous:
Creates and executes the following:
- '%HOMEPATH%\AppData\Roaming\Audio\codec.exe'
