Technical Information
Modifies file system
Creates the following files
- %TEMP%\245082510020959.jpg
- %TEMP%\310682446218680.jpg
- %TEMP%\142293065914891.jpg
Deletes the following files
- %TEMP%\245082510020959.jpg
Network activity
Connects to
- 'mt##.##0.yahoodns.net':25
- 'ma##.#islogic.com':25
- 'sp##.#cebox.co.za':25
- 'za########bound-1.mimecast.co.za':25
- 'ma##.#ubesko.co.za':25
- 'sm#####1.f1.k8.com.br':25
- 'mx##.ionos.com':25
- 'ALT1.ASPMX.L.GOOGLE.com':25
- 'mx###1.qq.com':25
- 'ap##########o.mail.protection.outlook.com':25
- 'mi######01.prd.na.dynmx.net':25
- 'ma##.#-email.net':25
- 'sm###n.rzone.de':25
- 'AS####.GOOGLEMAIL.com':25
- 'mx#####.ppe-hosted.com':25
- 'mx#.gov.md':25
- 'ju#########.mail.protection.outlook.com':25
- 'mx#######f01.gslb.pphosted.com':25
- 'mx#.#ailgun.org':25
- 'd3#####.#.#ss.de.barracudanetworks.com':25
- 'si#########.secureintellicentre.net.au':25
- 'mi######d.supramail.com.br':25
- 'mx##.#-trust.org':25
- 'mx#.###wardemail.net':25
- 'sm##.oi.net.br':25
- 'so#########.mail.protection.outlook.com':25
- 'te############m-com-br.mail.protection.outlook.com':25
- 'ok###############nalmemorial-org.mail.protection.outlook.com':25
- 'ma##.#mipro.co.za':25
- 'ur#########.mail.protection.outlook.com':25
- 'mx.##.#ocaweb.com.br':25
- 'ma##.#quensys.com':25
- '10######0.pamx1.hotmail.com':25
- '18#.#15.113.66':80
- '0f##############18-992f-bc109b59ed59.in.tmes.trendmicro.com':25
- 'alt2.aspmx.l.google.com':25
- 'us#######nbound-1.mimecast.com':25
- 'alt3.aspmx.l.google.com':25
- 'mx#.###nturserver.de':25
- '1-###d-mx04.com':25
- 'ma###.###hangeadministrado.com':25
- 'te##########za.mail.protection.outlook.com':25
- 'mx.########ity.com.cust.hostedemail.com':25
- 'sc#####.myemailservice.com':25
- 'fl####anxpress.com':25
- 'fa######mx.spamexperts.eu':25
- 'ic###azip.com':80
- '42#.##icname.com':25
- 'ma##.#abelovna.cz':25
- 'mx#.###amailservers.com':25
- 'in.###babusiness.it':25
- 'no##.#or.navy.mil':25
- 'mx#.##empresas.pt':25
- 'ma##.#iscalinet.ch':25
- 'ma###.gdol.ga.gov':25
- 'ma######e1.secureserver.net':25
- 'ma####1.supsi.ch':25
- 'localhost':25
- 'd6#####.##s.barracudanetworks.com':25
- 'my###.####l-protect.gosecure.net':25
- 'la###ell.com':25
- 'ce######.##il.protection.outlook.com':25
- 'ma##.eleccon.cl':25
- 'mx.##omuzzi.com':25
TCP
HTTP GET requests
- http://ic###azip.com/
- http://18#.#15.113.66/corp/n.txt
- http://18#.#15.113.66/corp/a
- http://18#.#15.113.66/corp/1201.txt
Other
- 'alt2.aspmx.l.google.com':25
- 'za########bound-1.mimecast.co.za':25
- 'ALT1.ASPMX.L.GOOGLE.com':25
- 'sm###n.rzone.de':25
- 'ma##.#-email.net':25
- 'mi######01.prd.na.dynmx.net':25
- 'mx###1.qq.com':25
- 'mx#####.ppe-hosted.com':25
- 'aspmx.l.google.com':25
- 'mx#.gov.md':25
- 'mx#.#ailgun.org':25
- 'd3#####.#.#ss.de.barracudanetworks.com':25
- 'sp##.#cebox.co.za':25
- 'sm#####1.f1.k8.com.br':25
- 'mi######d.supramail.com.br':25
- 'mx##.#-trust.org':25
- 'ur#########.mail.protection.outlook.com':25
- 'ju#########.mail.protection.outlook.com':25
- 'ma##.#quensys.com':25
- '10######0.pamx1.hotmail.com':25
- 'AS####.GOOGLEMAIL.com':25
- 'us#######nbound-1.mimecast.com':25
- 'mx#.###nturserver.de':25
- 'alt3.aspmx.l.google.com':25
- 'te##########za.mail.protection.outlook.com':25
- 'mx.########ity.com.cust.hostedemail.com':25
- 'sc#####.myemailservice.com':25
- '1-###d-mx04.com':25
- '0f##############18-992f-bc109b59ed59.in.tmes.trendmicro.com':25
- 'fa######mx.spamexperts.eu':25
- 'ce######.##il.protection.outlook.com':25
- 'mx#.###amailservers.com':25
- 'ma##.#iscalinet.ch':25
- 'mx#.##empresas.pt':25
- 'ma####1.supsi.ch':25
- 'd6#####.##s.barracudanetworks.com':25
- 'my###.####l-protect.gosecure.net':25
- 'ma##.#abelovna.cz':25
- 'mx#.###wardemail.net':25
- 'so#########.mail.protection.outlook.com':25
UDP
- DNS ASK ya##o.com
- DNS ASK cb##.org.br
- DNS ASK ap###sorco.no
- DNS ASK wo#####enueyachts.com
- DNS ASK 66##.com
- DNS ASK ap##########o.mail.protection.outlook.com
- DNS ASK bu##y.com
- DNS ASK mi######01.prd.na.dynmx.net
- DNS ASK 12##.com
- DNS ASK ma##.#-email.net
- DNS ASK ei###tedt.com
- DNS ASK am###o.co.za
- DNS ASK sm###n.rzone.de
- DNS ASK 18##.com
- DNS ASK me###.gov.md
- DNS ASK mx#.gov.md
- DNS ASK me##on.com
- DNS ASK ma##.#mipro.co.za
- DNS ASK va####rdarep.com.br
- DNS ASK 79##.com
- DNS ASK ur##350.net
- DNS ASK in###matica.com
- DNS ASK ur#########.mail.protection.outlook.com
- DNS ASK mx#######f01.gslb.pphosted.com
- DNS ASK mx###1.qq.com
- DNS ASK ju##ter.com
- DNS ASK ALT1.ASPMX.L.GOOGLE.com
- DNS ASK 53##.com
- DNS ASK 11##.com
- DNS ASK os###n.com.br
- DNS ASK mu###era.co.za
- DNS ASK aspmx.l.google.com
- DNS ASK sp##.#cebox.co.za
- DNS ASK mu###ko.co.za
- DNS ASK 49##.com
- DNS ASK 76##.com
- DNS ASK t-###tems.co.za
- DNS ASK 08##.com
- DNS ASK za########bound-1.mimecast.co.za
- DNS ASK es####demestres.com
- DNS ASK 33##.com
- DNS ASK 55##.com
- DNS ASK ra####hchina.org
- DNS ASK ma##.#ubesko.co.za
- DNS ASK hi#####gntextile.com
- DNS ASK sm#####1.f1.k8.com.br
- DNS ASK 63##.com
- DNS ASK mi#####eebrewers.com
- DNS ASK mm###ntl.com
- DNS ASK mx##.ionos.com
- DNS ASK me###faust.com
- DNS ASK ww###gns.com
- DNS ASK oi.#et.br
- DNS ASK ni####oveis.com.br
- DNS ASK 81##.com
- DNS ASK 21##.com
- DNS ASK te#####etelecom.com.br
- DNS ASK sm##.oi.net.br
- DNS ASK ld##tp.com
- DNS ASK mx#.###wardemail.net
- DNS ASK ar##t.com
- DNS ASK el##con.cl
- DNS ASK 69##.com
- DNS ASK so##law.com
- DNS ASK 80##.com
- DNS ASK so#########.mail.protection.outlook.com
- DNS ASK 27##.com
- DNS ASK if####aquari.edu.br
- DNS ASK ad#####rearchive.com
- DNS ASK ma##.eleccon.cl
- DNS ASK ok########tynationalmemorial.org
- DNS ASK te############m-com-br.mail.protection.outlook.com
- DNS ASK ok###############nalmemorial-org.mail.protection.outlook.com
- DNS ASK be##0.com
- DNS ASK 94##.com
- DNS ASK le###zzi.com
- DNS ASK ts###ne.gov.za
- DNS ASK mx.##omuzzi.com
- DNS ASK 00##.com
- DNS ASK co###e.com.ve
- DNS ASK un###i.edu.br
- DNS ASK mx##.#-trust.org
- DNS ASK cr###endu.com
- DNS ASK 91##.com
- DNS ASK mx#.#ailgun.org
- DNS ASK fd#.pt
- DNS ASK ig.#com.br
- DNS ASK gl###wood.ie
- DNS ASK 32##.com
- DNS ASK sp###e.com.br
- DNS ASK d3#####.#.#ss.de.barracudanetworks.com
- DNS ASK ca##.gov.au
- DNS ASK 05##.com
- DNS ASK 29##.com
- DNS ASK si#########.secureintellicentre.net.au
- DNS ASK 40##.com
- DNS ASK es##s.org
- DNS ASK 98##.com
- DNS ASK gi#r.co
- DNS ASK mi######d.supramail.com.br
- DNS ASK 19##.com
- DNS ASK ja####nroadfire.com
- DNS ASK 77##.com
- DNS ASK us.mil
- DNS ASK b-##ust.org
- DNS ASK ju#########.mail.protection.outlook.com
- DNS ASK le##2.com
- DNS ASK ma##.#islogic.com
- DNS ASK ka###ovna.cz
- DNS ASK 82##.com
- DNS ASK ma###.###hangeadministrado.com
- DNS ASK
- DNS ASK na##en.com
- DNS ASK 14##.com
- DNS ASK te###ure.co.za
- DNS ASK pr##ary.net
- DNS ASK te##########za.mail.protection.outlook.com
- DNS ASK mx.########ity.com.cust.hostedemail.com
- DNS ASK sc#####.myemailservice.com
- DNS ASK vz#.##acberry.net
- DNS ASK 42#.##icname.com
- DNS ASK di###i.tkk.fi
- DNS ASK 48##.com
- DNS ASK rt##s.co.za
- DNS ASK ch###s.ocn.ne.j
- DNS ASK 42##.com
- DNS ASK cv###.navy.mil
- DNS ASK fa######mx.spamexperts.eu
- DNS ASK ho##ails.ec
- DNS ASK 62##.com
- DNS ASK ce##l.br
- DNS ASK al##ev.ro
- DNS ASK ma###one.com
- DNS ASK ce######.##il.protection.outlook.com
- DNS ASK fw#.#gqvbr.com
- DNS ASK 52##.com
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK ic###azip.com
- DNS ASK ag#.gov.br
- DNS ASK uc#.edu.co
- DNS ASK le##pot.ca
- DNS ASK es####arte.g12.br
- DNS ASK 0f##############18-992f-bc109b59ed59.in.tmes.trendmicro.com
- DNS ASK alt2.aspmx.l.google.com
- DNS ASK su####kcountyny.gov
- DNS ASK us#######nbound-1.mimecast.com
- DNS ASK fr###erve.com
- DNS ASK alt3.aspmx.l.google.com
- DNS ASK li###po.co.za
- DNS ASK he##erg.com
- DNS ASK 90##.com
- DNS ASK mx#.###nturserver.de
- DNS ASK ma##.tmcc.edu
- DNS ASK 42#.com
- DNS ASK 58##.com
- DNS ASK 1-###d-mx04.com
- DNS ASK ca####sombras.cl
- DNS ASK 04##.com
- DNS ASK fl####anxpress.com
- DNS ASK la###ncipal.com
- DNS ASK le###teck.com
- DNS ASK mx#####.ppe-hosted.com
- DNS ASK ma##.#abelovna.cz
- DNS ASK id##a.ch
- DNS ASK ma####1.supsi.ch
- DNS ASK bl###ive.com.br
- DNS ASK pr###ssor.co
- DNS ASK le####d-neil.com
- DNS ASK d6#####.##s.barracudanetworks.com
- DNS ASK af###et.co.za
- DNS ASK la###ell.com
- DNS ASK 83##.com
- DNS ASK cq###sys.com
- DNS ASK my###.####l-protect.gosecure.net
- DNS ASK ea###link.ca
- DNS ASK un####ais.com.br
- DNS ASK ma##.#quensys.com
- DNS ASK am###nte.eng.br
- DNS ASK 07##.com
- DNS ASK ga###army.com
- DNS ASK 10######0.pamx1.hotmail.com
- DNS ASK eb##gc.com
- DNS ASK mx.##.#ocaweb.com.br
- DNS ASK au###oison.com
- DNS ASK AS####.GOOGLEMAIL.com
- DNS ASK ii###gic.com
- DNS ASK ha####rdschools.org
- DNS ASK in###cta.com
- DNS ASK ma######e1.secureserver.net
- DNS ASK ze###uste.net
- DNS ASK ab##e.com
- DNS ASK r2###hool.com
- DNS ASK le##er.com
- DNS ASK no##.#or.navy.mil
- DNS ASK 75##.com
- DNS ASK wi###edia.com
- DNS ASK 25##.com
- DNS ASK fu######lmproductions.com
- DNS ASK mx#.###amailservers.com
- DNS ASK pw##.com
- DNS ASK pa###etti.net
- DNS ASK ta##leo.com
- DNS ASK in.###babusiness.it
- DNS ASK fr##olde.pt
- DNS ASK hc###er.combr
- DNS ASK mx#.##empresas.pt
- DNS ASK ti###linet.ch
- DNS ASK ma##.#iscalinet.ch
- DNS ASK tr#####ionfitness.com
- DNS ASK do#.#tate.ga.us
- DNS ASK ma###.gdol.ga.gov
- DNS ASK ya##hoo.com
- DNS ASK ho##ali.com
- DNS ASK 45##.com
- DNS ASK gr####eres.com.br
