Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Update
- Windows Defender
Modifies file system
Creates the following files
- %TEMP%\ixp000.tmp\pr279316.exe
- %TEMP%\ixp000.tmp\qu895617.exe
Network activity
Connects to
- '18#.#61.248.152':38452
Miscellaneous
Creates and executes the following
- '%TEMP%\ixp000.tmp\pr279316.exe'
- '%TEMP%\ixp000.tmp\qu895617.exe'
Executes the following
- '%TEMP%\ixp000.tmp\pr279316.exe' ' (with hidden window)
- '%TEMP%\ixp000.tmp\qu895617.exe' ' (with hidden window)
