Technical Information
Malicious functions:
Creates and executes the following:
- '<SYSTEM32>\wscript.exe' "c:\11916581917187F0ABD858AD4d35.vbs"
- '<SYSTEM32>\wscript.exe' "c:\7D15028F.vbs"
Executes the following:
- '<SYSTEM32>\wbem\scrcons.exe' -Embedding
- '<SYSTEM32>\cmd.exe' /c afc9fe2f418b00a0.bat
- '%CommonProgramFiles%\8C10A2FC.exe'
Modifies file system:
Creates the following files:
- <Current directory>\ocpmyuuncf
- C:\1.INI
- <Current directory>\afc9fe2f418b00a0.bat
- C:\11916581917187F0ABD858AD4d35.vbs
- %CommonProgramFiles%\8C10A2FC.exe
- %CommonProgramFiles%\BJ.exe
- %CommonProgramFiles%\BF.ini
- C:\7D15028F.vbs
- <SYSTEM32>\NOD32.ini
Deletes the following files:
- %CommonProgramFiles%\8C10A2FC.exe
- <Current directory>\ocpmyuuncf
- <Current directory>\1.INI
Moves the following files:
- from C:\1.INI to <Current directory>\1.INI
Network activity:
Connects to:
- 'po##.3322.org':3635
UDP:
- DNS ASK po##.3322.org
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: 'ИрРЗіМРтЙэј¶ЦР'
- ClassName: '' WindowName: '??????????????'
- ClassName: 'Shell_TrayWnd' WindowName: ''
