Technical Information
Malicious functions
Injects code into
the following user processes:
- soldier.exe
Modifies file system
Creates the following files
- %TEMP%\ixp000.tmp\namespace.ppt
- %TEMP%\ixp000.tmp\typing.ppt
- %TEMP%\ixp000.tmp\released
- %TEMP%\ixp000.tmp\relatively
- %TEMP%\ixp000.tmp\nor
- %TEMP%\ixp000.tmp\app
- %TEMP%\ixp000.tmp\53007\soldier.exe
- %TEMP%\ixp000.tmp\53007\u
Deletes following files that it created itself
- %TEMP%\ixp000.tmp\53007\u
- %TEMP%\ixp000.tmp\app
- %TEMP%\ixp000.tmp\nor
- %TEMP%\ixp000.tmp\relatively
- %TEMP%\ixp000.tmp\released
- %TEMP%\ixp000.tmp\typing.ppt
- %TEMP%\ixp000.tmp\namespace.ppt
- %TEMP%\ixp000.tmp\53007\soldier.exe
Network activity
Connects to
- 'te##gram.me':443
UDP
- DNS ASK dQ##########umJDCWrI.dQYlHUZHICYNumJDCWrI
- DNS ASK te##gram.me
Miscellaneous
Creates and executes the following
- '%TEMP%\ixp000.tmp\53007\soldier.exe' u
- '%TEMP%\ixp000.tmp\53007\soldier.exe'
Executes the following
- '<SYSTEM32>\reg.exe' /dfghskhjdf987347589374a
- '<SYSTEM32>\cmd.exe' /c lfdKZFPkQ & type Typing.ppt | %comspec%
- '<SYSTEM32>\cmd.exe' /S /D /c" type Typing.ppt "
- '<SYSTEM32>\cmd.exe'
- '<SYSTEM32>\findstr.exe' /V "Amino" Released
- '<SYSTEM32>\reg.exe' /dfghskhjdf987347589374a' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c lfdKZFPkQ & type Typing.ppt | %comspec%' (with hidden window)
