Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'MeslekTesti' = '"%HOMEPATH%\documents\mt\meslek testi.exe" regden'
Modifies file system:
Creates the following files:
- %HOMEPATH%\documents\mt\assets\font-awesome\scss\_animated.scss
- %HOMEPATH%\documents\mt\assets\font-awesome\scss\font-awesome.scss
- %HOMEPATH%\documents\mt\assets\font-awesome\less\variables.less
- %HOMEPATH%\documents\mt\assets\font-awesome\scss\_fixed-width.scss
- %HOMEPATH%\documents\mt\assets\font-awesome\scss\_core.scss
- %HOMEPATH%\documents\mt\assets\font-awesome\scss\_bordered-pulled.scss
- %HOMEPATH%\documents\mt\assets\font-awesome\less\stacked.less
- %HOMEPATH%\documents\mt\assets\font-awesome\less\mixins.less
- %HOMEPATH%\documents\mt\assets\font-awesome\less\list.less
- %HOMEPATH%\documents\mt\assets\font-awesome\less\larger.less
- %HOMEPATH%\documents\mt\assets\font-awesome\less\screen-reader.less
- %HOMEPATH%\documents\mt\assets\font-awesome\less\rotated-flipped.less
- %HOMEPATH%\documents\mt\assets\font-awesome\less\path.less
- %HOMEPATH%\documents\mt\assets\font-awesome\scss\_icons.scss
- %HOMEPATH%\documents\mt\assets\img\yazdir.png
- %HOMEPATH%\documents\mt\assets\font-awesome.min.css
- %HOMEPATH%\documents\mt\assets\font-awesome\scss\_variables.scss
- %HOMEPATH%\documents\mt\getpath.exe
- %HOMEPATH%\documents\mt\assets\stiller.css
- %HOMEPATH%\documents\mt\assets\rar.exe
- %HOMEPATH%\documents\mt\assets\font-awesome\scss\_stacked.scss
- %HOMEPATH%\documents\mt\assets\font-awesome\scss\_mixins.scss
- %HOMEPATH%\documents\mt\assets\font-awesome\scss\_list.scss
- %HOMEPATH%\documents\mt\assets\font-awesome\scss\_larger.scss
- %HOMEPATH%\documents\mt\assets\font-awesome\scss\_screen-reader.scss
- %HOMEPATH%\documents\mt\assets\font-awesome\scss\_rotated-flipped.scss
- %HOMEPATH%\documents\mt\assets\font-awesome\scss\_path.scss
- %HOMEPATH%\documents\mt\assets\amcharts\light.js
- %HOMEPATH%\documents\mt\assets\amcharts\export.min.js
- %HOMEPATH%\documents\mt\assets\amcharts\export.css
- %HOMEPATH%\documents\mt\assets\bootstrap.min.js
- %HOMEPATH%\documents\mt\assets\bootstrap.min.css
- %HOMEPATH%\documents\mt\assets\amcharts\serial.js
- %HOMEPATH%\documents\mt\assets\amcharts\amcharts.js
- %HOMEPATH%\documents\mt\sorular.txt
- %HOMEPATH%\documents\mt\Meslek Testi.exe.config
- %HOMEPATH%\documents\mt\Meslek Testi.exe
- %HOMEPATH%\documents\mt\assets\addons.rar
- %HOMEPATH%\documents\mt\assets\1kb.rar
- %HOMEPATH%\documents\mt\wi.sys
- %HOMEPATH%\documents\mt\assets\font-awesome\css\font-awesome.css
- %HOMEPATH%\documents\mt\assets\font-awesome\less\core.less
- %HOMEPATH%\documents\mt\assets\font-awesome\less\bordered-pulled.less
- %HOMEPATH%\documents\mt\assets\font-awesome\less\animated.less
- %HOMEPATH%\documents\mt\assets\font-awesome\less\icons.less
- %HOMEPATH%\documents\mt\assets\font-awesome\less\font-awesome.less
- %HOMEPATH%\documents\mt\assets\font-awesome\less\fixed-width.less
- %HOMEPATH%\documents\mt\assets\font-awesome\fonts\FontAwesome.otf
- %HOMEPATH%\documents\mt\assets\font-awesome\fonts\fontawesome-webfont.svg
- %HOMEPATH%\documents\mt\assets\font-awesome\fonts\fontawesome-webfont.eot
- %HOMEPATH%\documents\mt\assets\font-awesome\css\font-awesome.min.css
- %HOMEPATH%\documents\mt\assets\font-awesome\fonts\fontawesome-webfont.woff2
- %HOMEPATH%\documents\mt\assets\font-awesome\fonts\fontawesome-webfont.woff
- %HOMEPATH%\documents\mt\assets\font-awesome\fonts\fontawesome-webfont.ttf
Network activity:
Connects to:
- 'fa####ehberlik.com':443
- 'wp#d':80
TCP:
HTTP GET requests:
- http://11#.#11.111.1/wpad.dat via wp#d
UDP:
- DNS ASK fa####ehberlik.com
- DNS ASK wp#d
Miscellaneous:
Searches for the following windows:
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following:
- '%HOMEPATH%\documents\mt\Meslek Testi.exe'
