Technical Information
Modifies file system
Creates the following files
- %TEMP%\e_n4\krnln.fne
- %TEMP%\e_n4\internet.fne
- %TEMP%\e_n4\eapi.fne
- nul
Deletes itself.
Network activity
UDP
- DNS ASK mx##18.cn
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: '<File name>.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ping -n 5 127.0.0.1 > nul && cd <Current directory> && del /f /q <File name>.exe&& exit
- '%WINDIR%\syswow64\ping.exe' -n 5 127.0.0.1
- '%WINDIR%\syswow64\cmd.exe' /c ping -n 5 127.0.0.1 > nul && cd <Current directory> && del /f /q <File name>.exe&& exit' (with hidden window)
