Technical Information
Modifies file system
Creates the following files
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-2922372159-162323534-3872807762-1001\83aa4cc77f591dfc2374580bbd95f6ba_597d9903-ea81-40e6-803a-40d3e5258fa4
- <Current directory>\hugerain.new
- nul
Moves the following files
- from <Current directory>\hugerain.new to <Current directory>\hugerain.exe
Deletes itself.
Network activity
TCP
- 'bh#p.in':443
UDP
- DNS ASK bh#p.in
Miscellaneous
Executes the following
- '%ProgramFiles%\java\jre7\bin\javaw.exe' -Dlaunch4j.exedir="<Current directory>" -Dlaunch4j.exefile="<Full path to file>" -jar "<Full path to file>"
- '<SYSTEM32>\cmd.exe' "/c start "Unpacking updates..." cmd /c "<SYSTEM32>\ping -n 3 127.0.0.1>nul && del /f /q "<Current directory>\hugerain.exe" "<Full path to file>" && ren "<Current directory>\hugerain.new" "huge...
- '<SYSTEM32>\cmd.exe' /c "<SYSTEM32>\ping -n 3 127.0.0.1>nul && del /f /q "<Current directory>\hugerain.exe" "<Full path to file>" && ren "<Current directory>\hugerain.new" "hugerain.exe" || pause""
- '<SYSTEM32>\ping.exe' -n 3 127.0.0.1
