Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'oinDh' = 'C:\\Users\\user\\AppData\\Local\\oinDhf\\[rfmoeghta-replace].hta'
- C:\users\user\appdata\local\oindhf\oindh.exe
- C:\users\user\appdata\local\oindhf\[rfmoegvbs-replace].vbs
- C:\users\user\appdata\local\oindhf\[rfmoeghta-replace].hta
- %APPDATA%\calc.exe
- %TEMP%\tmp52.tmp.bat
- 'fa#####bkaj.duckdns.org':1898
- DNS ASK fa#####bkaj.duckdns.org
- '%APPDATA%\calc.exe'
- '<SYSTEM32>\schtasks.exe' /create /f /sc ONLOGON /RL HIGHEST /tn "'calc"' /tr "'%APPDATA%\calc.exe"'' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /create /f /sc ONLOGON /RL HIGHEST /tn "'calc"' /tr "'%APPDATA%\calc.exe"'
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\tmp52.tmp.bat""