Technical Information
Modifies file system
Creates the following files
- C:\1.exe
- C:\5376.vbs
Deletes the following files
- C:\5376.vbs
Deletes itself.
Network activity
Connects to
- '43.##8.201.168':6188
- '43.##8.201.168':98
Miscellaneous
Creates and executes the following
- 'C:\1.exe'
- '%WINDIR%\syswow64\wscript.exe' "C:\5376.vbs"
- '%WINDIR%\syswow64\wscript.exe' "C:\5376.vbs"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del <Full path to file> > nul' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c del <Full path to file> > nul
