Technical Information
Modifies file system
Creates the following files
- %TEMP%\qie2015\12449.dll
Substitutes the following executable files
- <Full path to file>
Moves itself
- from <Full path to file> to <Current directory>\csqeqe.temp
Deletes itself.
Network activity
Connects to
- 'ba##u.com':80
- 'yz##e.com':80
- 'yz##e.com':8080
TCP
HTTP GET requests
- http://www.ba##u.com/
- http://www.yz##e.com/qegg/qegg.txt
UDP
- DNS ASK ba##u.com
- DNS ASK yz##e.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c del "<Current directory>\csqeqe.temp"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c del "<Current directory>\csqeqe.temp"
- '%WINDIR%\syswow64\calc.exe'
