Technical Information
Modifies file system
Creates the following files
- <Current directory>\tearful trickster jamaal callison.exe
- <Current directory>\bunifu_ui_v1.5.4.dll
- nul
- <Current directory>\gb_v1.68.exe
Deletes the following files
- <Current directory>\tearful trickster jamaal callison.exe
Deletes itself.
Network activity
Connects to
- 'ga####ooster.net':80
- 'ga####ooster.net':443
TCP
HTTP GET requests
- http://ga####ooster.net/download/pubg/loader.exe
Other
- 'ga####ooster.net':443
UDP
- DNS ASK ga####ooster.net
Miscellaneous
Creates and executes the following
- '<Current directory>\tearful trickster jamaal callison.exe'
- '%WINDIR%\syswow64\cmd.exe' /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "<Full path to file>"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "<Current directory>\Tearful Trickster Jamaal Callison.exe"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "<Full path to file>"
- '%WINDIR%\syswow64\ping.exe' 1.1.1.1 -n 1 -w 3000
- '%WINDIR%\syswow64\cmd.exe' /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "<Current directory>\Tearful Trickster Jamaal Callison.exe"
