Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\wincache\devsv510b7de5.exe
- %APPDATA%\wincache\devsv8169030d.exe
Modifies file system
Creates the following files
- %APPDATA%\wincache\devsv2605c4df.exe
- %APPDATA%\wincache\desktop.ini
- %APPDATA%\devw7f188e68.exe
- %APPDATA%\devt8169030d.dat
- %APPDATA%\dce3aaf997.bin
Deletes following files that it created itself
- %APPDATA%\wincache\devsv2605c4df.exe
- %APPDATA%\devw7f188e68.exe
Network activity
Connects to
- '14#.#8.76.119':7689
TCP
HTTP GET requests
- http://14#.##.76.119:7689/KehuA/dwmc.bin via 14#.#8.76.119
Miscellaneous
Creates and executes the following
- '%APPDATA%\devw7f188e68.exe' /w
- '%APPDATA%\wincache\devsv510b7de5.exe'
- '%APPDATA%\devt8169030d.dat' /d
Executes the following
- '%APPDATA%\devw7f188e68.exe' /w' (with hidden window)
- '%APPDATA%\wincache\devsv510b7de5.exe' ' (with hidden window)
- '%APPDATA%\devt8169030d.dat' /d' (with hidden window)
