Technical Information
Modifies file system
Creates the following files
- %APPDATA%\r3update.exe
- <Current directory>\error2.bat
- %APPDATA%\%d1%87%d0%b8%d1%82%d1%8b.exe
Sets the 'hidden' attribute to the following files
- %APPDATA%\%d1%87%d0%b8%d1%82%d1%8b.exe
Deletes itself.
Network activity
TCP
HTTP GET requests
- http://www.google.com/
UDP
- DNS ASK google.com
- DNS ASK cd#####.anonfiles.com
- DNS ASK an###iles.com
Miscellaneous
Creates and executes the following
- '%APPDATA%\r3update.exe'
- '%APPDATA%\r3update.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""<Current directory>\error2.bat" "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C choice /C Y /N /D Y /T 0 & Del "<Full path to file>' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c ""<Current directory>\error2.bat" "
- '<SYSTEM32>\cmd.exe' /C choice /C Y /N /D Y /T 0 & Del "<Full path to file>
- '<SYSTEM32>\choice.exe' /C Y /N /D Y /T 0
