Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\ping.exe' -n 2 127.0.0.1
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\update.bat" "
Modifies file system:
Creates the following files:
- %TEMP%\kodi.png
- %TEMP%\aut4.tmp
- %TEMP%\update.txt
- %TEMP%\update.bat
- %TEMP%\update.exe
- %TEMP%\TexturePacker.exe
- %TEMP%\base.exe
- %TEMP%\aut1.tmp
- %TEMP%\aut2.tmp
- %TEMP%\aut3.tmp
- %TEMP%\D3DX9_43.dll
Deletes the following files:
- %TEMP%\aut3.tmp
- %TEMP%\aut4.tmp
- %TEMP%\aut1.tmp
- %TEMP%\aut2.tmp
Moves the following files:
- from %TEMP%\update.exe to %TEMP%\<File name>.exe
Substitutes the following executable files:
- <Full path to file>
Deletes itself.
Network activity:
Connects to:
- 'ip####rpixels.eu':80
TCP:
HTTP GET requests:
- http://ip####rpixels.eu/scripts/update.exe
- http://ip####rpixels.eu/scripts/update.txt
UDP:
- DNS ASK ip####rpixels.eu
