Technical Information
Modifies file system
Creates the following files
- <Current directory>\gay.log
- conout$
- <PATH_SAMPLE>_new.exe
- nul
Substitutes the following executable files
- <Full path to file>
Moves itself
- from <Full path to file> to <PATH_SAMPLE>_old.exe
Network activity
Connects to
- 'ic##en.fr':443
TCP
Other
- 'ic##en.fr':443
UDP
- DNS ASK ic##en.fr
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /c timeout /t 1 /nobreak >nul & move /y "<Full path to file>" "<PATH_SAMPLE>_old.exe" & move /y "<PATH_SAMPLE>_new.exe" "<Full path to file>" & start "" "<Full path to file>"
- '<SYSTEM32>\timeout.exe' /t 1 /nobreak
- '<SYSTEM32>\cmd.exe' /c timeout /t 1 /nobreak >nul & move /y "<Full path to file>" "<PATH_SAMPLE>_old.exe" & move /y "<PATH_SAMPLE>_new.exe" "<Full path to file>" & start "" "<Full path to file>"' (with hidden window)
