Technical Information
Modifies file system
Creates the following files
- C:\programfiles\logs.exe
- %TEMP%\mrabf6wb.cmdline
- %TEMP%\mrabf6wb.out
- %APPDATA%\logs
- %TEMP%\vbc4b5e.tmp
- %TEMP%\res4b5f.tmp
- C:\far2.exe
- %TEMP%\mrabf6wb.0.vb
- C:\msocache.exe
- %TEMP%\gc5n4yu3.out
- %TEMP%\vbc4f65.tmp
- %TEMP%\res4f66.tmp
- C:\perflogs.exe
- %TEMP%\svuzx0ns.0.vb
- %TEMP%\gc5n4yu3.0.vb
- %TEMP%\gc5n4yu3.cmdline
- %TEMP%\res4535.tmp
- %TEMP%\vbc4534.tmp
- %TEMP%\doxe3ivc.out
- %TEMP%\ztmzc0zd.0.vb
- %TEMP%\ztmzc0zd.cmdline
- %TEMP%\ztmzc0zd.out
- %TEMP%\vbc35c3.tmp
- %TEMP%\res35c4.tmp
- C:\$recycle.bin.exe
- %PROGRAMDATA%\programfiles\ixdpnfwun.ico
- %TEMP%\sc_1ngel.0.vb
- %TEMP%\sc_1ngel.out
- %TEMP%\vbc3c4a.tmp
- %TEMP%\res3c4b.tmp
- C:\documents and settings.exe
- %TEMP%\doxe3ivc.0.vb
- %TEMP%\doxe3ivc.cmdline
- %TEMP%\sc_1ngel.cmdline
- %TEMP%\svuzx0ns.cmdline
- %TEMP%\svuzx0ns.out
Sets the 'hidden' attribute to the following files
- C:\programfiles\logs.exe
Deletes the following files
- %TEMP%\res35c4.tmp
- %TEMP%\gc5n4yu3.0.vb
- %TEMP%\gc5n4yu3.out
- %TEMP%\gc5n4yu3.cmdline
- %TEMP%\vbc4f65.tmp
- %TEMP%\res4f66.tmp
- %TEMP%\mrabf6wb.out
- %TEMP%\mrabf6wb.cmdline
- %TEMP%\mrabf6wb.0.vb
- %TEMP%\vbc4b5e.tmp
- %TEMP%\res4b5f.tmp
- %TEMP%\doxe3ivc.0.vb
- %TEMP%\svuzx0ns.cmdline
- %TEMP%\doxe3ivc.out
- %TEMP%\vbc4534.tmp
- %TEMP%\res4535.tmp
- %TEMP%\sc_1ngel.cmdline
- %TEMP%\sc_1ngel.0.vb
- %TEMP%\sc_1ngel.out
- %TEMP%\vbc3c4a.tmp
- %TEMP%\res3c4b.tmp
- %TEMP%\ztmzc0zd.cmdline
- %TEMP%\ztmzc0zd.out
- %TEMP%\ztmzc0zd.0.vb
- %TEMP%\vbc35c3.tmp
- %TEMP%\doxe3ivc.cmdline
- %TEMP%\svuzx0ns.0.vb
Network activity
TCP
- 'xe###.ddns.net':443
UDP
- DNS ASK xe###.ddns.net
Miscellaneous
Creates and executes the following
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ztmzc0zd.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES35C4.tmp" "%TEMP%\vbc35C3.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\sc_1ngel.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3C4B.tmp" "%TEMP%\vbc3C4A.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\doxe3ivc.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4535.tmp" "%TEMP%\vbc4534.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mrabf6wb.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4B5F.tmp" "%TEMP%\vbc4B5E.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\gc5n4yu3.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4F66.tmp" "%TEMP%\vbc4F65.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\svuzx0ns.cmdline"' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ztmzc0zd.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES35C4.tmp" "%TEMP%\vbc35C3.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\sc_1ngel.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3C4B.tmp" "%TEMP%\vbc3C4A.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\doxe3ivc.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4535.tmp" "%TEMP%\vbc4534.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mrabf6wb.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4B5F.tmp" "%TEMP%\vbc4B5E.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\gc5n4yu3.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4F66.tmp" "%TEMP%\vbc4F65.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\svuzx0ns.cmdline"
- '%WINDIR%\syswow64\rundll32.exe' <SYSTEM32>\shell32.dll,OpenAs_RunDLL %APPDATA%\Logs
