Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\kali.exe
Modifies file system
Creates the following files
- %HOMEPATH%\documents\ñô´º¹ºîï°é.png
- %HOMEPATH%\favorites\ñô´º¹ºîï°é.png
- D:\ñô´º¹ºîï°é.png
- %HOMEPATH%\desktop\ñô´º¹ºîï°é.png
- D:\ñô´º¹ºîï°é.lnk
- %HOMEPATH%\documents\ñô´º¹ºîï°é.lnk
- %HOMEPATH%\favorites\ñô´º¹ºîï°é.lnk
- %HOMEPATH%\desktop\ñô´º¹ºîï°é.lnk
Substitutes the following executable files
- <Full path to file>
Moves itself
- from <Full path to file> to %TEMP%\[e238b071a14814ac806883db829af435]
Network activity
Connects to
- 'ba##u.com':80
TCP
HTTP GET requests
- http://www.ba##u.com/
UDP
- DNS ASK ba##u.com
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\explorer.exe' <PATH_SAMPLE>
