Technical Information
Modifies file system
Creates the following files
- %TEMP%\450b.tmp
- %TEMP%\4d30.tmp
- %TEMP%\4d00.tmp
- %TEMP%\4ce0.tmp
- %TEMP%\4cb0.tmp
- %TEMP%\4c80.tmp
- %TEMP%\4c41.tmp
- %TEMP%\4c11.tmp
- %TEMP%\4be1.tmp
- %TEMP%\4bb2.tmp
- %TEMP%\4b82.tmp
- %TEMP%\4b42.tmp
- %TEMP%\4b13.tmp
- %TEMP%\4ae3.tmp
- %TEMP%\4ab3.tmp
- %TEMP%\4a74.tmp
- %TEMP%\4979.tmp
- %TEMP%\48ad.tmp
- %TEMP%\487d.tmp
- %TEMP%\47c1.tmp
- %TEMP%\4791.tmp
- %TEMP%\4649.tmp
- %TEMP%\4619.tmp
- %TEMP%\45e9.tmp
- %TEMP%\459a.tmp
- %TEMP%\455a.tmp
- %TEMP%\4d60.tmp
- %TEMP%\4d9f.tmp
Deletes the following files
- %TEMP%\455a.tmp
- %TEMP%\459a.tmp
- %TEMP%\45e9.tmp
- %TEMP%\4619.tmp
- %TEMP%\4649.tmp
- %TEMP%\4791.tmp
- %TEMP%\47c1.tmp
- %TEMP%\487d.tmp
- %TEMP%\48ad.tmp
- %TEMP%\4979.tmp
- %TEMP%\4a74.tmp
Deletes itself.
Network activity
Connects to
- 'pe###o22.top':80
TCP
HTTP POST requests
- http://pe###o22.top/gate.php
UDP
- DNS ASK pe###o22.top
- DNS ASK vu###s02.top
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c timeout -t 5 && del "<Full path to file>"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c timeout -t 5 && del "<Full path to file>"
- '%WINDIR%\syswow64\timeout.exe' -t 5
