Technical Information
Malicious functions
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\syswow64\cmd.exe
Modifies file system
Creates the following files
- %TEMP%\aut925e.tmp
- %TEMP%\aupair_7f155fe43f519ab3a6bb116265f90877.jpg
- %TEMP%\aut926f.tmp
- %TEMP%\1.exe
Deletes the following files
- %TEMP%\aut925e.tmp
- %TEMP%\aut926f.tmp
Network activity
TCP
HTTP GET requests
- http://www.ar###haring.com/do.php?do#########
UDP
- DNS ASK ar###haring.com
Miscellaneous
Creates and executes the following
- '%TEMP%\1.exe'
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\1.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\aupair_7f155fe43f519ab3a6bb116265f90877.jpg' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\aupair_7f155fe43f519ab3a6bb116265f90877.jpg
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\1.exe
