Technical Information
Network activity
Connects to
- 'bi#o.cn':80
TCP
HTTP GET requests
- http://www.bi#o.cn/Union/zz.htm
- http://www.bi#o.cn/union/softfy.asp?ne##################################
- http://www.bi#o.cn/ie/union/softfy.asp?ne##################################
UDP
- DNS ASK bi#o.cn
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c rmdir /s/q "%TEMP%\smd#\' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c rmdir /s/q "%TEMP%\$2312\' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c rmdir /s/q "%TEMP%\smd#\
- '%WINDIR%\syswow64\cmd.exe' /c rmdir /s/q "%TEMP%\$2312\
