Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\peercreator
Modifies file system
Creates the following files
- %APPDATA%\wsystempeers\wpeerc.exe
- nul
- %APPDATA%\wsystempeers\rcx6f5f.tmp
Moves the following files
- from %APPDATA%\wsystempeers\rcx6f5f.tmp to %APPDATA%\wsystempeers\wpeerc.exe
Network activity
Connects to
- 'ap#.#pify.org':80
- '<LOCALNET>.3.101':1443
TCP
HTTP GET requests
- http://ap#.#pify.org/
UDP
- DNS ASK ap#.#pify.org
Miscellaneous
Creates and executes the following
- '%APPDATA%\wsystempeers\wpeerc.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c schtasks /Create /TN "PeerCreator" /TR "%APPDATA%\WSystemPeers\WPeerC.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul
- '<SYSTEM32>\schtasks.exe' /Create /TN "PeerCreator" /TR "%APPDATA%\WSystemPeers\WPeerC.exe" /SC ONLOGON /RL HIGHEST /F
