Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\<File name>.js
Malicious functions
Creates and executes the following
- '%TEMP%\support.exe' "%TEMP%\au.dat"
Modifies file system
Creates the following files
- %HOMEPATH%\pictures\<File name>.js
- %TEMP%\au.ini
- %TEMP%\app.zip
- %TEMP%\au.dat
- %TEMP%\support.exe
Deletes following files that it created itself
- %TEMP%\app.zip
Network activity
Connects to
- '21#.#0.76.250':7707
TCP
Other
- '21#.#0.76.250':7707
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /c schtasks /create /sc minute /mo 15 /tn <File name>.js /tr %HOMEPATH%\Pictures\<File name>.js /f
- '<SYSTEM32>\schtasks.exe' /create /sc minute /mo 15 /tn <File name>.js /tr %HOMEPATH%\Pictures\<File name>.js /f
- '%TEMP%\support.exe' "%TEMP%\au.dat"' (with hidden window)
