Technical Information
Modifies file system
Creates the following files
- <Current directory>\0oe6gypx2.exe
- <Current directory>\config.ini
Moves the following files
- from <Full path to file> to %TEMP%\0oe6gypx2\....\0oe6gypx2
Deletes itself.
Network activity
Connects to
- 'te##.##sthotel360.com':80
- 'ht##.##sthotel360.com':80
TCP
HTTP GET requests
- http://te##.##sthotel360.com/001/puppet.Txt?39####
- http://te##.##sthotel360.com/Data/A2NVQ4V6E64ESEESJlSJ4JLNOQYSJ2NJJO6lECO1VLOlSLV2Q4214OJ66LCLQ2J11C4lCVLO4261O6QJY2lJEYYlLSNQO4C6NCQJlV4ENNl66JlLYNLSSSVY6CVJ32303231C4EA39D4C233C8D535CAB13339B...
- http://te##.##sthotel360.com/001/Tips.txt?40####
- http://ht##.##sthotel360.com/HttpApiGb.ashx?ac###################################################################################################################################################...
- http://ht##.##sthotel360.com/HttpApiGb.ashx?ac#################
UDP
- DNS ASK te##.##sthotel360.com
- DNS ASK ht##.##sthotel360.com
Miscellaneous
Searches for the following windows
- ClassName: 'Progman' WindowName: 'Program Manager'
- ClassName: 'CrossFire' WindowName: ''
Executes the following
- '%WINDIR%\syswow64\ipconfig.exe' /flushdns
