Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\<File name>
Modifies file system
Creates the following files
- %APPDATA%\microsoft\windows\<File name>.exe
- %TEMP%\<File name>_task.xml
Sets the 'hidden' attribute to the following files
- %APPDATA%\microsoft\windows\<File name>.exe
Deletes following files that it created itself
- %TEMP%\<File name>_task.xml
Network activity
Connects to
- '45.##.177.70':7777
Miscellaneous
Creates and executes the following
- '%APPDATA%\microsoft\windows\<File name>.exe'
Executes the following
- '<SYSTEM32>\schtasks.exe' /Create /XML %TEMP%\<File name>_task.xml /TN <File name> /F
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "(Get-WmiObject -Query \"select Name from Win32_Processor\").Name"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "(Get-WmiObject -Query \"Select Name from Win32_VideoController\").Name"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "(Get-WmiObject -Query \"select * from Win32_OperatingSystem\").Caption"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "(Get-WmiObject -Query \"select TotalPhysicalMemory from Win32_ComputerSystem\").TotalPhysicalMemory"
- '<SYSTEM32>\schtasks.exe' /Create /XML %TEMP%\<File name>_task.xml /TN <File name> /F' (with hidden window)
- '%APPDATA%\microsoft\windows\<File name>.exe' ' (with hidden window)
