Technical Information
Modifies file system
Creates the following files
- %TEMP%\2b34.tmp
- %TEMP%\2ba3.tmp
- %TEMP%\2be2.tmp
- <Full path to file>{157132f5-3773-4062-ba1a-68b4bf709539}
- <Current directory>\rcx2c9f.tmp
Deletes the following files
- %TEMP%\2b34.tmp
- %TEMP%\2ba3.tmp
- %TEMP%\2be2.tmp
- <Full path to file>{157132f5-3773-4062-ba1a-68b4bf709539}
Moves the following files
- from <Current directory>\rcx2c9f.tmp to <Full path to file>{157132f5-3773-4062-ba1a-68b4bf709539}
Substitutes the following executable files
- <Full path to file>
Moves itself
- from <Full path to file> to %TEMP%\_@2c7f.tmp
Network activity
Connects to
- 'cf#####i.blog.163.com':80
TCP
HTTP GET requests
- http://cf#####i.blog.163.com/blog/static/217955126201561644131661/
- http://bl##.163.com/login.do?er#####
UDP
- DNS ASK cf#####i.blog.163.com
- DNS ASK bl##.163.com
