Technical Information
Modifies file system
Creates the following files
- %TEMP%\tmpac07.tmp
- %TEMP%\tmpac18.tmp
- <Current directory>\killme.exe
- <Current directory>\ob.runner_v1_0.zip
- <Current directory>\ob.runner.exe
Deletes the following files
- %TEMP%\tmpac07.tmp
- %TEMP%\tmpac18.tmp
Deletes itself.
Network activity
Connects to
- 'ap#.#pify.org':443
- 'ro#######c.azurewebsites.net':80
- 'ro#########ers.blob.core.windows.net':443
TCP
HTTP POST requests
- http://ro#######c.azurewebsites.net/Customer.svc/json/CheckAppMetaData
Other
- 'ap#.#pify.org':443
- 'ro#########ers.blob.core.windows.net':443
UDP
- DNS ASK ap#.#pify.org
- DNS ASK ro#######c.azurewebsites.net
- DNS ASK ro#########ers.blob.core.windows.net
Miscellaneous
Creates and executes the following
- '<Current directory>\killme.exe' <File name>.exe OB.Runner_V1_0.zip <Current directory>\
- '<Current directory>\killme.exe' <File name>.exe OB.Runner_V1_0.zip <Current directory>\' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c ""C:\\Windows\\SysWOW64\\CScript.exe" //U //NoLogo //E:vbscript "C:\\Users\\user\\AppData\\Local\\Temp\\tmpAC07.tmp" 2> "C:\\Users\\user\\AppData\\Local\\Temp\\tmpAC08.tmp" > "C:\\Users\\u...
- '%WINDIR%\syswow64\cscript.exe' //U //NoLogo //E:vbscript "C:\\Users\\user\\AppData\\Local\\Temp\\tmpAC07.tmp"
