Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im Steam.exe
Modifies file system
Creates the following files
- %TEMP%\7zipsfx.000\filesh.bat
- %TEMP%\7zipsfx.000\cert.exe
Deletes following files that it created itself
- %TEMP%\7zipsfx.000\cert.exe
- %TEMP%\7zipsfx.000\filesh.bat
Modifies the HOSTS file.
Network activity
Connects to
- 'ap#.##legram.org':443
UDP
- DNS ASK ap#.##legram.org
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\7zipsfx.000\cert.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\7ZipSfx.000\FilesH.bat" "
- '%WINDIR%\syswow64\timeout.exe' /t 1
