Technical Information
Modifies file system
Creates the following files
- %TEMP%\cc14.tmp
- %TEMP%\cca2.tmp
- %TEMP%\cd10.tmp
- %TEMP%\cd7e.tmp
- %TEMP%\cd8f.tmp
- %TEMP%\cdbf.tmp
- %TEMP%\cdcf.tmp
- %TEMP%\cdef.tmp
- %TEMP%\cdf0.tmp
- <Full path to file>{7e15ddeb-8bd6-49f4-a0a4-c65a3e36480c}
- <Current directory>\rcxcf3a.tmp
Deletes the following files
- %TEMP%\cc14.tmp
- %TEMP%\cca2.tmp
- %TEMP%\cd10.tmp
- %TEMP%\cd7e.tmp
- %TEMP%\cd8f.tmp
- %TEMP%\cdbf.tmp
- %TEMP%\cdcf.tmp
- %TEMP%\cdef.tmp
- %TEMP%\cdf0.tmp
- <Full path to file>{7e15ddeb-8bd6-49f4-a0a4-c65a3e36480c}
Moves the following files
- from <Current directory>\rcxcf3a.tmp to <Full path to file>{7e15ddeb-8bd6-49f4-a0a4-c65a3e36480c}
Substitutes the following executable files
- <Full path to file>
Moves itself
- from <Full path to file> to %TEMP%\_@ce8d.tmp
Network activity
Connects to
- 'cf#####i.blog.163.com':80
TCP
HTTP GET requests
- http://cf#####i.blog.163.com/blog/static/21795512620156505533625/
- http://bl##.163.com/login.do?er#####
UDP
- DNS ASK cf#####i.blog.163.com
- DNS ASK bl##.163.com
