Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /F /IM "<File name>.exe"
Modifies file system
Creates the following files
- <Current directory>\system\launcher\config\version.dat
- <Current directory>\rflauncher_new.exe
- <Current directory>\update_0b919dfcc8f046fe82c40fca0e5b2cbe.bat
- %LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\<File name>.exe.log
- nul
Network activity
Connects to
- 'rf######pines-admincp.net':443
TCP
Other
- 'rf######pines-admincp.net':443
UDP
- DNS ASK rf######pines-admincp.net
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '<Full path to file>'
Restarts the analyzed sample
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c "<Current directory>\update_0b919dfcc8f046fe82c40fca0e5b2cbe.bat"
- '%WINDIR%\syswow64\timeout.exe' /t 2 /nobreak
