Technical Information
Modifies file system
Creates the following files
- %TEMP%\unif6b.tmp.bat
Deletes itself.
Network activity
Connects to
- '18#.#89.241.200':18899
- '18#.#89.241.158':15899
- '45.##8.9.231':23101
- '18#.#89.241.198':18899
TCP
HTTP GET requests
- http://18#.#89.241.158/cr.jpg?v=#######
- http://18#.#89.241.200/client/s?u=################################################################
- http://45.##8.9.231/hokdf.jpg?v=#######
- http://18#.#89.241.198/client/s?u=##################################################################
UDP
- '23#.#79.128.235':23759
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\UniF6B.tmp.bat""' (with hidden window)
Executes the following
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "<Full path to file>"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\UniF6B.tmp.bat""
