Technical Information
Modifies file system
Creates the following files
- %TEMP%\rarsfx0\logad.exe
- %TEMP%\rarsfx0\read.bat
- %TEMP%\rarsfx1\kiwarg.exe
Deletes following files that it created itself
- %TEMP%\rarsfx0\logad.exe
Network activity
Connects to
- 'di######tangyflippan.shop':443
- 'x1.#.lencr.org':80
- 'ma#####condfucews.shop':443
- 'gr#####stellesqwm.shop':443
- 'cr#.#ectigo.com':80
- 'st#####ummyskiwffe.shop':443
- 'st######gularrmsnhw.shop':443
- 'la######legapingkwaq.shop':443
- 'st######comperewhitwo.shop':443
TCP
HTTP GET requests
- http://x1.#.lencr.org/
- http://cr#.#ectigo.com/SectigoPublicServerAuthenticationRootR46.p7c
Other
- 'di######tangyflippan.shop':443
- 'ma#####condfucews.shop':443
- 'gr#####stellesqwm.shop':443
- 'st######gularrmsnhw.shop':443
- 'in#####rdanytiresw.shop':443
UDP
- DNS ASK gr#####assifytalk.shop
- DNS ASK di######tangyflippan.shop
- DNS ASK x1.#.lencr.org
- DNS ASK ma#####condfucews.shop
- DNS ASK gr#####stellesqwm.shop
- DNS ASK cr#.#ectigo.com
- DNS ASK st#####ummyskiwffe.shop
- DNS ASK st######gularrmsnhw.shop
- DNS ASK la######legapingkwaq.shop
- DNS ASK in#####rdanytiresw.shop
- DNS ASK st######comperewhitwo.shop
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%TEMP%\rarsfx0\logad.exe' -pmultit
- '%TEMP%\rarsfx1\kiwarg.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\read.bat" "
