Technical Information
Malicious functions
Injects code into
the following user processes:
- iexplore.exe
Modifies file system
Creates the following files
- %TEMP%\getx64btit.exe
- %TEMP%\x64btit.txt
- %TEMP%\{998302cd-a072-4019-af7b-c265ff854f42}\temp
Deletes the following files
- %TEMP%\x64btit.txt
- %TEMP%\getx64btit.exe
Network activity
TCP
HTTP GET requests
- http://19#.#8.81.140/tor/status-vote/current/consensus
- http://54.#8.36.44/tor/server/fp/dbd915f96e467c1bfbc17e6b03688897fa25e449
- http://10#.#89.10.190/tor/server/fp/d0ce898b1530c14f9fce27e1449941579607f1d6
- http://18#.#04.1.239/tor/server/fp/1a002b6e163d502f23381391718e11a568976403
- http://86.##.119.83/tor/server/fp/4ff3becdca79a51d1a83ff0a11a2fd9250b9b942
- http://54.##.120.156/tor/server/fp/269fd646ca46bf2b671c4b89a0691fb9490a6cb8
- http://13#.#01.3.75/tor/server/fp/d8b16fb9cdff228c03b1a628b3b45620f93e320a
- http://89.#1.57.58/tor/server/fp/d4fbe51bc35c3921f31b6e561fd8c07bc56f9d71
- http://80.##7.137.19/tor/server/fp/1e7bde03151aab779cb4afeaeea52536ffaa9400
- http://19#.#41.252.63/tor/server/fp/cc4a3ae960e3617f49bf9887b79186c14cba6813
- http://19#.#54.237.179/tor/server/fp/4eb55679fa91363b97372554f8dc7c63f4e5b101
- http://21#.#7.239.83/tor/server/fp/9c7bffd05386834f669353cf4a1ecf547e6ae414
- http://15#.#2.127.239/tor/server/fp/8d1085e818d0473ec693e3b0911ff18741f1f2df
UDP
- DNS ASK ap#.#pify.org
- DNS ASK ti###a.nist.gov
Miscellaneous
Creates and executes the following
- '%TEMP%\getx64btit.exe'
