Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\microsoft\windows\maps\mapstask
Modifies file system
Creates the following files
- %WINDIR%\p2pclient.exe
- %LOCALAPPDATA%\kc quality consult ltd\p2pclient\org.peer2profit.p2pminimal.ini.lock
- %LOCALAPPDATA%\kc quality consult ltd\p2pclient\org.peer2profit.p2pminimal.ini.xskqiv
Deletes the following files
- %LOCALAPPDATA%\kc quality consult ltd\p2pclient\org.peer2profit.p2pminimal.ini.lock
Moves the following files
- from %LOCALAPPDATA%\kc quality consult ltd\p2pclient\org.peer2profit.p2pminimal.ini.xskqiv to %LOCALAPPDATA%\kc quality consult ltd\p2pclient\org.peer2profit.p2pminimal.ini
Network activity
Connects to
- '80.##.27.198':80
- 'ap#.###r2profit.global':443
- '81.##1.15.109':443
- 'fp.#####.peer2profit.site':443
- 'ub##tu.com':443
- 'google.com':443
- 'gi##ub.com':443
- 'yo##ube.com':443
- 'tw##ter.com':443
- 'ap#.##ocklist.de':80
- 'ot#.##ienvault.com':443
- 'th###tcrowd.org':443
TCP
HTTP GET requests
- http://80.##.27.198/p2pbinary
- http://ap#.##ocklist.de/api.php?ip#######################
Other
- 'ap#.###r2profit.global':443
- '81.##1.15.109':443
- 'fp.#####.peer2profit.site':443
- 'ub##tu.com':443
- 'google.com':443
- 'gi##ub.com':443
- 'yo##ube.com':443
- 'tw##ter.com':443
- 'ot#.##ienvault.com':443
- 'th###tcrowd.org':443
UDP
- DNS ASK ap#.###r2profit.global
- DNS ASK 10#.##.#71.81.in-addr.arpa
- DNS ASK fp.#####.peer2profit.site
- DNS ASK google.com
- DNS ASK gi##ub.com
- DNS ASK ub##tu.com
- DNS ASK yo##ube.com
- DNS ASK tw##ter.com
- DNS ASK ap#.##ocklist.de
- DNS ASK ot#.##ienvault.com
- DNS ASK th###tcrowd.org
Miscellaneous
Creates and executes the following
- '%WINDIR%\p2pclient.exe' -l unauthorised.conns@proton.me
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwAiAA==
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -EncodedCommand QwA6AFwAVwBpAG4AZABvAHcAcwBcAHAAMgBwAGMAbABpAGUAbgB0ACAALQBsACAAdQBuAGEAdQB0AGgAbwByAGkAcwBlAGQALgBjAG8AbgBuAHMAQABwAHIAbwB0AG8AbgAuAG0AZQA=
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -EncodedCommand cwBjAGgAdABhAHMAawBzACAALwBDAHIAZQBhAHQAZQAgAC8AVABOACAAIgBNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABNAGEAcABzAFwATQBhAHAAcwBUAGEAcwBrACIAIAAvAFQAUgAgACIAQwA6AFwAVwBpAG4AZ...
- '<SYSTEM32>\schtasks.exe' /Create /TN Microsoft\Windows\Maps\MapsTask /TR "%WINDIR%\p2pclient.exe -l unauthorised.conns@proton.me" /SC ONLOGON
