Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im TPHelper.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im TASLogin.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im TP3Helper.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im GameLoader.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im TGuardSvc.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im txplatform.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im TPSvc.exe
Modifies file system
Moves the following files
- from <Full path to file> to %TEMP%\_@16bc.tmp
- from %TEMP%\_@16bc.tmp to %TEMP%\1054410\....\ВЎВЎ
Substitutes the following executable files
- <Full path to file>
Moves itself
- from <Full path to file> to %TEMP%\_@16ab.tmp
- from %TEMP%\_@16ab.tmp to %TEMP%\1054395\....\ВЎВЎ
Network activity
TCP
Other
- '34.##9.100.209':443
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im TPHelper.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im TASLogin.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im TP3Helper.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im GameLoader.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im TGuardSvc.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im txplatform.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im TPSvc.exe' (with hidden window)
