Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\webbingqq
Modifies file system
Creates the following files
- C:\users\public\macfee.dat
- C:\users\public\kingsoft.dat
- C:\users\public\vaxplorer\donottrace.txt
- C:\users\public\vaxplorer\libcurl.dll
- C:\users\public\vaxplorer\libeay32.dll
- C:\users\public\vaxplorer\libssh2.dll
- C:\users\public\vaxplorer\mirag.dll
- C:\users\public\vaxplorer\msvcp100.dll
- C:\users\public\vaxplorer\msvcr100.dll
- C:\users\public\vaxplorer\qtdata.dll
- C:\users\public\vaxplorer\ssleay32.dll
- C:\users\public\vaxplorer\task.dat
- C:\users\public\vaxplorer\vaxplorer.exe
- C:\users\public\vaxplorer\zlib.dll
- C:\users\public\vaxplorer\vaxplorer.dat
Deletes the following files
- C:\users\public\kingsoft.dat
Network activity
Connects to
- 'dl##k.host':443
- 'ke####.#l.files.1drv.com':443
- 'pa###bin.com':443
- 'ne###.#ookielive.top':2890
- 'be##.##stdangdang.com':6318
TCP
Other
- 'dl##k.host':443
- 'ke####.#l.files.1drv.com':443
- 'pa###bin.com':443
- 'ne###.#ookielive.top':2890
- 'be##.##stdangdang.com':6318
UDP
- DNS ASK dl##k.host
- DNS ASK ke####.#l.files.1drv.com
- DNS ASK pa###bin.com
- DNS ASK ne###.#ookielive.top
- DNS ASK be##.##stdangdang.com
Miscellaneous
Creates and executes the following
- 'C:\users\public\vaxplorer\vaxplorer.exe'
- 'C:\users\public\vaxplorer\vaxplorer.exe' ' (with hidden window)
