Technical Information
Malicious functions:
Creates and executes the following:
- '' (downloaded from the Internet)
Modifies file system:
Creates the following files:
- %APPDATA%\popo.exe
- %APPDATA%\Acr.exe
Network activity:
Connects to:
- 'ip###ger.com':443
- 'lo##ver.su':80
- 'do#####d.acronis.com':80
TCP:
HTTP GET requests:
- http://lo##ver.su/1.exe
- http://do#####d.acronis.com/AcronisTrueImage2018_web.exe
UDP:
- DNS ASK ip###ger.com
- DNS ASK lo##ver.su
- DNS ASK do#####d.acronis.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'AutoHotkey' WindowName: '<Full path to file>'
Creates and executes the following:
- '%APPDATA%\popo.exe'
- '%APPDATA%\Acr.exe'
