Technical Information
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'haleng' = '%HOMEPATH%\AppData'
- %TEMP%\jfiag3g_gg.exe
- %TEMP%\fj4ghga23_fsa.txt
- %TEMP%\haleng.exe
- http://ip##pi.com/json/
- http://ue#####6gh.2ihsfa.com/api/fbtime
- DNS ASK ip##pi.com
- DNS ASK fa###ook.com
- DNS ASK ue#####6gh.2ihsfa.com
- '%TEMP%\jfiag3g_gg.exe' /scookiestxt %TEMP%\fj4ghga23_fsa.txt
- '%TEMP%\jfiag3g_gg.exe' /scookiestxt %TEMP%\fj4ghga23_fsa.txt' (with hidden window)