Technical Information
Modifies file system
Creates the following files
- %TEMP%\nsu9fc7.tmp
- C:\installer-wizard_v1u.8c.6.exe
- %TEMP%\installer-wizard_v1u.8c.6\installer-wizard_v1u.8c.6.exe
- %TEMP%\rarsfx0\installer_installergenius_express_v8a.5.exe
Deletes following files that it created itself
- %TEMP%\installer-wizard_v1u.8c.6\installer-wizard_v1u.8c.6.exe
Modifies the following files
- %LOCALAPPDATA%\microsoft\penworkspace\discovercachedata.dat
Network activity
Connects to
- 'ip##.ipleak.net':443
- 'x1.#.lencr.org':80
- 'js#######holder.typicode.com':443
- '91.##5.85.210':39452
TCP
HTTP GET requests
- http://x1.#.lencr.org/
Other
- 'ip##.ipleak.net':443
- 'js#######holder.typicode.com':443
UDP
- DNS ASK ip##.ipleak.net
- DNS ASK x1.#.lencr.org
- DNS ASK google.com
- DNS ASK microsoft.com
- DNS ASK ap##e.com
- DNS ASK bu###eed.com
- DNS ASK ap#.#uotable.io
- DNS ASK js#######holder.typicode.com
- DNS ASK sc#####ficamerican.com
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%TEMP%\installer-wizard_v1u.8c.6\installer-wizard_v1u.8c.6.exe' -p6ikPGBRN4sDkOOffieibGijfzniOEns1lRDtqnLcNDNZBRe7V1NR7iNX8fqssciRaL97lVY4Df
- '%TEMP%\rarsfx0\installer_installergenius_express_v8a.5.exe'
Executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe'
