Technical Information
Malicious functions:
Creates and executes the following:
- '%WINDIR%\C8A63C84.exe'
- '%WINDIR%\E94676E9.exe'
Executes the following:
- '<SYSTEM32>\cmd.exe' /c afc9fe2f418b00a0.bat
- '<SYSTEM32>\wscript.exe' "c:\D34FD3F5.vbs"
- '<SYSTEM32>\taskkill.exe' /f /im KSafeTray.exe
Modifies file system :
Creates the following files:
- %WINDIR%\C8A63C84.exe
- C:\D34FD3F5.vbs
- <Current directory>\jfumpbaxht
- <Current directory>\afc9fe2f418b00a0.bat
- %WINDIR%\BF.exe
- C:\1.INI
- %WINDIR%\E94676E9.exe
- %WINDIR%\BF.ini
- <SYSTEM32>\NOD32.ini
- %WINDIR%\BJ.exe
Deletes the following files:
- <Current directory>\jfumpbaxht
- <Current directory>\1.INI
Moves the following files:
- from C:\1.INI to <Current directory>\1.INI
Deletes itself.
Network activity:
Connects to:
- '92####er.9966.org':521
UDP:
- DNS ASK 92####er.9966.org
Miscellaneous:
Searches for the following windows:
- ClassName: '(null)' WindowName: '??????????????'
- ClassName: '(null)' WindowName: '(null)'
