Technical Information
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'haleng' = '%HOMEPATH%\AppDat'
- %TEMP%\haleng.exe
- %TEMP%\jfiag3g_gg.exe
- %TEMP%\fj4ghga23_fsa.txt
- %TEMP%\jfiag3g_gg.exe
- %TEMP%\fj4ghga23_fsa.txt
- %TEMP%\jfiag3g_gg.exe
- %TEMP%\fj4ghga23_fsa.txt
- 'ip##pi.com':80
- 'fa###ook.com':443
- 'fa###ook.com':443
- DNS ASK ip##pi.com
- DNS ASK fa###ook.com
- DNS ASK ue#####6gh.2ihsfa.com
- '%TEMP%\jfiag3g_gg.exe' /scookiestxt %TEMP%\fj4ghga23_fsa.txt
- '%TEMP%\jfiag3g_gg.exe' /scookiestxt %TEMP%\fj4ghga23_fsa.txt' (with hidden window)