Technical Information
Modifies file system
Creates the following files
- %TEMP%\265502186420375.jpg
Network activity
Connects to
- 'mx#.mail.ru':25
- 'jo###onn.net':25
- 'us#######inbound-1.mimecast.com':25
- 'mx.###turylink.net':25
- 'tr#####.hugedomains.com':25
- 'ma##.#rotonmail.ch':25
- 'mx.######.prod.msg.synchronoss.net':25
- 'mx.##a.untd.com':25
- 'mx#.#harter.net':25
- 'MX#.####1-17.CA.IPHMX.com':25
- 'mx##.####hlink-vadesecure.net':25
- 'in######-net.mx.av-mx.com':25
- 'mx.#td.net':25
- 'mx#.free.fr':25
- 'mx#######002.gslb.pphosted.com':25
- 'mx.##ghes.net':25
- 'ex###########com0i.mail.protection.outlook.com':25
- 'mx#.##.sac.in.mcn.org':25
- 'mx#.###vateemail.com':25
- 'mx#######e01.gslb.pphosted.com':25
- 'am##########w.mail.protection.outlook.com':25
- 'cx#.##.#.cloudfilter.net':25
- 'mt##.##0.yahoodns.net':25
- 'mx##.mail.com':25
- 'sm####n.libero.it':25
- 'mx###.##.everycloudtech.com':25
- 'al######x-vip2.prodigy.net':25
- '18#.#15.113.66':80
- 'pa####x.above.com':25
- 'mx####.##il.gm0.yahoodns.net':25
- 'ms#####.##c.protection.outlook.com':25
- 'mx##.##il.icloud.com':25
- 'mx###.comcast.net':25
- 'pi#####t-mx3.synaq.com':25
- 'po#.#scom.net':25
- 'ff######x-vip1.prodigy.net':25
- 'alt1.aspmx.l.google.com':25
- 'ic###azip.com':80
- 'ri###########rg-com.mail.protection.outlook.com':25
- 'pk#####.#sg.pkvw.co.charter.net':25
- 'aj#####.##il.protection.outlook.com':25
- 'al######x-vip1.prodigy.net':25
- 'sh###w-oaks.com':25
- 'mx####.carrierzone.com':25
- 'wa######.##il.protection.outlook.com':25
- 'alt2.aspmx.l.google.com':25
- 'da###oland.net':25
- 'us#######nbound-1.mimecast.com':25
- 'mx#######901.gslb.pphosted.com':25
- 'pi######net.mx.av-mx.com':25
- 'cl######.us.messagelabs.com':25
- 'mx#####.ppe-hosted.com':25
TCP
HTTP GET requests
- http://ic###azip.com/
- http://18#.#15.113.66/fnl/n.txt
- http://18#.#15.113.66/fnl/273.txt
Other
- 'mx####.##il.gm0.yahoodns.net':25
- 'mx#.###vateemail.com':25
- 'mx#.##.sac.in.mcn.org':25
- 'ex###########com0i.mail.protection.outlook.com':25
- 'mx#.mail.ru':25
- 'aspmx.l.google.com':25
- 'MX#.####1-17.CA.IPHMX.com':25
- 'mt##.##0.yahoodns.net':25
- 'ma##.#rotonmail.ch':25
- 'us#######inbound-1.mimecast.com':25
- 'mx###.##.everycloudtech.com':25
- 'pa####x.above.com':25
- 'al######x-vip2.prodigy.net':25
- 'mx#####.ppe-hosted.com':25
- 'us#######nbound-1.mimecast.com':25
- 'mx####.carrierzone.com':25
- 'al######x-vip1.prodigy.net':25
- 'sh###w-oaks.com':25
- 'pi######net.mx.av-mx.com':25
- 'aj#####.##il.protection.outlook.com':25
- 'pi#####t-mx3.synaq.com':25
- 'alt1.aspmx.l.google.com':25
- 'ri###########rg-com.mail.protection.outlook.com':25
- 'ff######x-vip1.prodigy.net':25
- 'po#.#scom.net':25
- 'mx##.##il.icloud.com':25
- 'ms#####.##c.protection.outlook.com':25
- 'alt2.aspmx.l.google.com':25
- 'am##########w.mail.protection.outlook.com':25
UDP
- DNS ASK ma#l.ru
- DNS ASK mx.##a.untd.com
- DNS ASK ch##ter.net
- DNS ASK 00##.com
- DNS ASK 49##.com
- DNS ASK mx#.#harter.net
- DNS ASK 55##.com
- DNS ASK mx.######.prod.msg.synchronoss.net
- DNS ASK ju##.com
- DNS ASK 96##.com
- DNS ASK pt#.net
- DNS ASK ga##.net
- DNS ASK mx.#td.net
- DNS ASK 06##.com
- DNS ASK ym##l.com
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK rb##m.com
- DNS ASK MX#.####1-17.CA.IPHMX.com
- DNS ASK op###line.net
- DNS ASK 65##.com
- DNS ASK 27##.com
- DNS ASK jo###onn.net
- DNS ASK in######-net.mx.av-mx.com
- DNS ASK em###qmail.com
- DNS ASK us#######inbound-1.mimecast.com
- DNS ASK bo####travel.com
- DNS ASK mx.###turylink.net
- DNS ASK 37##.com
- DNS ASK al##ica.com
- DNS ASK ai#.com
- DNS ASK ga##.com
- DNS ASK 44##.com
- DNS ASK ma##.#rotonmail.ch
- DNS ASK pa##ell.net
- DNS ASK 48##.com
- DNS ASK cs.com
- DNS ASK ma#.com
- DNS ASK tr#####.hugedomains.com
- DNS ASK em##l.com
- DNS ASK 72##.com
- DNS ASK mx##.mail.com
- DNS ASK fr#e.fr
- DNS ASK se##y.com
- DNS ASK 59##.com
- DNS ASK mx#######e01.gslb.pphosted.com
- DNS ASK ad###hia.net
- DNS ASK ka##on.com
- DNS ASK am###n.com.tw
- DNS ASK co#.net
- DNS ASK am##########w.mail.protection.outlook.com
- DNS ASK mi######rcars.toyota.co.uk
- DNS ASK cl######.us.messagelabs.com
- DNS ASK cx#.##.#.cloudfilter.net
- DNS ASK 28##.com
- DNS ASK mx#####.ppe-hosted.com
- DNS ASK gr####noroofing.com
- DNS ASK 76##.com
- DNS ASK ma##.com
- DNS ASK 63##.com
- DNS ASK mx#.###vateemail.com
- DNS ASK mx#.##.sac.in.mcn.org
- DNS ASK ro###ail.com
- DNS ASK mc#.org
- DNS ASK mx#.free.fr
- DNS ASK 38##.com
- DNS ASK ni##.com
- DNS ASK mx#######002.gslb.pphosted.com
- DNS ASK au##mic.com
- DNS ASK 18##.com
- DNS ASK aspmx.l.google.com
- DNS ASK 79##.com
- DNS ASK 80##.com
- DNS ASK fr######osmetivos.com.br
- DNS ASK 52##.com
- DNS ASK hu##es.net
- DNS ASK mx.##ghes.net
- DNS ASK me.com
- DNS ASK 41##.com
- DNS ASK ex####gistics.com
- DNS ASK ex###########com0i.mail.protection.outlook.com
- DNS ASK ba######ndassociates.com
- DNS ASK in###tar.net
- DNS ASK mx##.####hlink-vadesecure.net
- DNS ASK 92##.com
- DNS ASK ff######x-vip1.prodigy.net
- DNS ASK in#####oatcompany.com
- DNS ASK 95##.com
- DNS ASK ri####dginsburg.com
- DNS ASK alt1.aspmx.l.google.com
- DNS ASK 88##.com
- DNS ASK 58##.com
- DNS ASK 82##.com
- DNS ASK 47##.com
- DNS ASK au###n.rr.com
- DNS ASK pi######net.mx.av-mx.com
- DNS ASK 14##.com
- DNS ASK pk#####.#sg.pkvw.co.charter.net
- DNS ASK mt###ara.com
- DNS ASK 75##.com
- DNS ASK pi##eer.net
- DNS ASK ri###########rg-com.mail.protection.outlook.com
- DNS ASK be###outh.net
- DNS ASK ms#.net
- DNS ASK po#.#scom.net
- DNS ASK ic###azip.com
- DNS ASK ms#.com
- DNS ASK pa####x.above.com
- DNS ASK ve##zon.net
- DNS ASK mx####.##il.gm0.yahoodns.net
- DNS ASK ms#####.##c.protection.outlook.com
- DNS ASK ic##ud.com
- DNS ASK mx#.mail.ru
- DNS ASK mx##.##il.icloud.com
- DNS ASK mx###.comcast.net
- DNS ASK di####erymail.co.za
- DNS ASK pi#####t-mx3.synaq.com
- DNS ASK gm#.il
- DNS ASK 17##.com
- DNS ASK 1s##m.net
- DNS ASK 54##.com
- DNS ASK co##ast.net
- DNS ASK 33##.com
- DNS ASK aj#.com
- DNS ASK 69##.com
- DNS ASK aj#####.##il.protection.outlook.com
- DNS ASK ro####ter.rr.com
- DNS ASK mx#######901.gslb.pphosted.com
- DNS ASK sa##lls.us
- DNS ASK us#######nbound-1.mimecast.com
- DNS ASK 24##.com
- DNS ASK 83##.com
- DNS ASK 03##.com
- DNS ASK at#.net
- DNS ASK al######x-vip2.prodigy.net
- DNS ASK gr###360.org
- DNS ASK 86##.com
- DNS ASK li##ro.it
- DNS ASK mx###.##.everycloudtech.com
- DNS ASK sm####n.libero.it
- DNS ASK 09##.com
- DNS ASK gl##al.net
- DNS ASK 71##.com
- DNS ASK 42##.com
- DNS ASK no####nmedical.com
- DNS ASK 31##.com
- DNS ASK wh###ercat.com
- DNS ASK sh###w-oaks.com
- DNS ASK 16##.com
- DNS ASK 51##.com
- DNS ASK sb###obal.net
- DNS ASK al######x-vip1.prodigy.net
- DNS ASK qu##net.com
- DNS ASK 57##.com
- DNS ASK da###oland.net
- DNS ASK mx####.carrierzone.com
- DNS ASK wa##.com
- DNS ASK wa######.##il.protection.outlook.com
- DNS ASK cc##e.org
- DNS ASK 34##.com
- DNS ASK cr#####abinelcamp.com
- DNS ASK 20##.com
- DNS ASK alt2.aspmx.l.google.com
- DNS ASK 02##.com
- DNS ASK ea###link.net
- DNS ASK ba###ga.life
