Technical Information
Modifies file system
Creates the following files
- <Current directory>\ppi8.exe
- <Current directory>\test install.exe
- <Current directory>\tracker.ps1
- <Current directory>\launchautorun.vbs
Sets the 'hidden' attribute to the following files
- <Current directory>\launchautorun.vbs
Network activity
Connects to
- 'fg###ub.shop':9932
- 'wi###11.site':443
TCP
HTTP POST requests
Other
- 'wi###11.site':443
UDP
- DNS ASK fg###ub.shop
- DNS ASK wi###11.site
Miscellaneous
Searches for the following windows
- ClassName: 'Edit' WindowName: ''
Creates and executes the following
- '<Current directory>\ppi8.exe'
- '<Current directory>\test install.exe'
- '<SYSTEM32>\wscript.exe' "<Current directory>\LaunchAutoRun.vbs"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -File "<Current directory>\tracker.ps1"
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -File "<Current directory>\tracker.ps1"' (with hidden window)
