Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Update
- Windows Defender
Injects code into
the following user processes:
- qu842623.exe
Modifies file system
Creates the following files
- %TEMP%\ixp000.tmp\un373088.exe
- %TEMP%\ixp000.tmp\si282596.exe
- %TEMP%\ixp001.tmp\un662136.exe
- %TEMP%\ixp001.tmp\rk925524.exe
- %TEMP%\ixp002.tmp\pr450457.exe
- %TEMP%\ixp002.tmp\qu842623.exe
Deletes the following files
- %TEMP%\ixp002.tmp\qu842623.exe
- %TEMP%\ixp002.tmp\pr450457.exe
Network activity
Connects to
- '18#.#61.248.151':38452
Miscellaneous
Creates and executes the following
- '%TEMP%\ixp000.tmp\un373088.exe'
- '%TEMP%\ixp001.tmp\un662136.exe'
- '%TEMP%\ixp002.tmp\pr450457.exe'
- '%TEMP%\ixp002.tmp\qu842623.exe'
- '%TEMP%\ixp001.tmp\rk925524.exe'
Executes the following
- '%TEMP%\ixp000.tmp\un373088.exe' ' (with hidden window)
- '%TEMP%\ixp001.tmp\un662136.exe' ' (with hidden window)
- '%TEMP%\ixp002.tmp\pr450457.exe' ' (with hidden window)
- '%TEMP%\ixp002.tmp\qu842623.exe' ' (with hidden window)
- '%TEMP%\ixp001.tmp\rk925524.exe' ' (with hidden window)
