Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'testfile' = '%HOMEPATH%\My Documents\testfile.exe'
- '' (downloaded from the Internet)
- %HOMEPATH%\My Documents\testfile.exe
- %HOMEPATH%\My Documents\xNet.dll
- %HOMEPATH%\My Documents\Ionic.Zip.dll
- %HOMEPATH%\My Documents\testfile.exe
- %HOMEPATH%\My Documents\xNet.dll
- %HOMEPATH%\My Documents\Ionic.Zip.dll
- <Full path to file>
- '95.##1.178.147':80
- http://95.##1.178.147/wp/log.php?s=############
- http://95.##1.178.147/wp/f/services.exe
- http://95.##1.178.147/wp/f/xNet.dll
- http://95.##1.178.147/wp/f/Ionic.Zip.dll
- http://95.##1.178.147/wp/log.php?s=###############
- '%HOMEPATH%\My Documents\testfile.exe'
- '<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "<Full path to file>"
- '<SYSTEM32>\ping.exe' 1.1.1.1 -n 1 -w 1000