Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\starcitizenbr
Modifies file system
Creates the following files
- %TEMP%\evb9f74.tmp
- %TEMP%\evba040.tmp
- %TEMP%\evba08f.tmp
- %TEMP%\evba0bf.tmp
- %TEMP%\evba10e.tmp
- %TEMP%\evba1da.tmp
- %TEMP%\evba21a.tmp
- %TEMP%\evba4da.tmp
- %TEMP%\evba596.tmp
- %TEMP%\evba5b7.tmp
- %TEMP%\evbaac9.tmp
- %TEMP%\evbaad9.tmp
Deletes following files that it created itself
- <SYSTEM32>\tasks\starcitizenbr
Network activity
Connects to
- 'ra#.####ubusercontent.com':443
- 'ap#.#ithub.com':443
- 'oc##.#ectigo.com':80
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?9e##############
Other
- 'ap#.#ithub.com':443
- 'ra#.####ubusercontent.com':443
UDP
- DNS ASK ra#.####ubusercontent.com
- DNS ASK ap#.#ithub.com
- DNS ASK oc##.#ectigo.com
- DNS ASK co##############e-chains.prod.autograph.services.mozaws.net
