Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\updater
Modifies file system
Creates the following files
- %TEMP%\content\4744-3160-<File name>.exe-08-30-23-301.dump
- %TEMP%\content\4744-3160-<File name>.exe-08-30-24-549.dump
- %APPDATA%\temp\updater.exe
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\<File name>.exe.log
- %TEMP%\content\972-856-updater.exe-08-30-28-041.dump
- %TEMP%\content\972-856-updater.exe-08-30-28-198.dump
Sets the 'hidden' attribute to the following files
- %APPDATA%\temp\updater.exe
Network activity
Connects to
- 'pa###bin.com':443
- '60.##5.216.60':9117
TCP
Other
- 'pa###bin.com':443
UDP
- DNS ASK pa###bin.com
Miscellaneous
Creates and executes the following
- '%APPDATA%\temp\updater.exe'
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn "Updater" /sc ONLOGON /tr "%APPDATA%\temp\Updater.exe" /rl HIGHEST /f
