Technical Information
Modifies file system
Creates the following files
- %TEMP%\aut18c5.tmp
- C:\f.exe
- %TEMP%\aut18c6.tmp
- C:\6.exe
Deletes the following files
- %TEMP%\aut18c5.tmp
- %TEMP%\aut18c6.tmp
Network activity
TCP
HTTP GET requests
- http://www.bi#.ly/0604_pokretanje
- http://fo###.gstatic.com/s/exo2/v7/7cHmv4okm5zmbtYsK-o.eot
- http://sh#.hr/wp-includes/js/jquery/jquery-migrate.min.js?ve#######
- http://sh#.hr/wp-content/themes/newsplus/responsive.css?ve########
- http://sh#.hr/wp-content/themes/newsplus-child/js/remodal/jquery.remodal.min.js
- http://sh#.hr/js/xgemius.js
- http://sh#.hr/wp-content/themes/newsplus-child/js/skriptz.js?3
- http://sh#.hr/wp-content/plugins/google-analytics-for-wordpress/assets/js/frontend.min.js?ve########
- http://sh#.hr/wp-content/plugins/login-with-ajax/widget/login-with-ajax.js?ve#######
- http://sh#.hr/wp-includes/js/jquery/jquery.js?ve########
- http://sh#.hr/wp-content/plugins/ultimate-posts-widget/css/upw-theme-standard.min.css?ve########
- http://sh#.hr/wp-content/themes/newsplus/user.css?ve########
- http://sh#.hr/wp-content/themes/newsplus/css/prettyPhoto.css?ve########
- http://sh#.hr/wp-includes/js/wp-emoji-release.min.js?ve########
- http://fo###.#oogleapis.com/css?fa########################################
- http://sh#.hr/wp-content/themes/newsplus-child/style.css?ve########
- http://hr######e.xclaimwords.net/script.aspx?pa##############
- http://sh#.hr/wp-content/plugins/wp-polls/polls-css.css?ve########
- http://sh#.hr/wp-content/plugins/gutenberg/build/core-blocks/style.css?ve############
- http://sh#.hr/wp-content/plugins/contact-form-7/includes/css/styles.css?ve#######
- http://sh#.hr/wp-content/plugins/login-with-ajax/widget/widget.css?ve#######
- http://sh#.hr/wp-content/themes/newsplus-child/js/remodal/jquery.remodal.css
- http://sh#.hr/
- http://www.fl###rect.com/css/for_sale_lander.css?15########
- http://www.sh#.hr/
- http://bi#.ly/0604_pokretanje
- http://www.fl###rect.com/?af##############
- http://sh#.hr/wp-content/themes/newsplus/css/ie.css?ve########
- http://www.go#####analytics.com/analytics.js
UDP
- DNS ASK bi#.ly
- DNS ASK fl###rect.com
- DNS ASK sh#.hr
- DNS ASK go#####agmanager.com
- DNS ASK st######h.bootstrapcdn.com
- DNS ASK cd###.#loudflare.com
- DNS ASK co##.jquery.com
- DNS ASK ht######m.googlecode.com
- DNS ASK hr######e.xclaimwords.net
- DNS ASK fo###.#oogleapis.com
- DNS ASK fo###.gstatic.com
- DNS ASK go#####analytics.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- 'C:\f.exe'
