Technical Information
Modifies file system
Creates the following files
- %TEMP%\selfdestruct_jumls12y.bat
- %TEMP%\selfdestruct_v1m7rxhs.bat
- %TEMP%\selfdestruct_tnxauvsk.bat
- nul
- %LOCALAPPDATA%\svchost.exe
- %TEMP%\selfdestruct_vk0nbpfa.bat
- %TEMP%\selfdestruct_l1hpgzsx.bat
- %TEMP%\selfdestruct_rvmfgq4r.bat
Deletes the following files
- %LOCALAPPDATA%\svchost.exe
Deletes itself.
Network activity
UDP
- DNS ASK co##############e-chains.prod.autograph.services.mozaws.net
Miscellaneous
Creates and executes the following
- '%LOCALAPPDATA%\svchost.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\selfdestruct_jUMlS12Y.bat"
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\selfdestruct_v1M7rXHS.bat"
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\selfdestruct_TnxaUvSK.bat"
- '<SYSTEM32>\timeout.exe' /t 2 /nobreak
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\selfdestruct_vK0nBpFA.bat"
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\selfdestruct_l1HPGzSx.bat"
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\selfdestruct_RvMFGq4R.bat"
