Technical Information
Modifies file system
Creates the following files
- %TEMP%\rename_and_restart.bat
- %WINDIR%\temp\tar7192.tmp
- %WINDIR%\temp\cab7191.tmp
- %WINDIR%\temp\tar5b91.tmp
- %WINDIR%\temp\cab5b90.tmp
- %WINDIR%\temp\tar5b41.tmp
- %WINDIR%\temp\cab5b40.tmp
- %WINDIR%\temp\tar4493.tmp
- %WINDIR%\temp\cab4492.tmp
- %WINDIR%\temp\tar43d6.tmp
- %WINDIR%\temp\cab43d5.tmp
- %WINDIR%\temp\tar2e32.tmp
- %WINDIR%\temp\cab2e31.tmp
- %WINDIR%\temp\tar2de2.tmp
- %WINDIR%\temp\cab2de1.tmp
- %WINDIR%\temp\tar17c1.tmp
- %WINDIR%\temp\cab17c0.tmp
- %WINDIR%\temp\tar1790.tmp
- %WINDIR%\temp\cab178f.tmp
- %WINDIR%\temp\tar1750.tmp
- %WINDIR%\temp\cab174f.tmp
- %WINDIR%\temp\tar1664.tmp
- %WINDIR%\temp\cab1663.tmp
- %WINDIR%\temp\tar62.tmp
- %WINDIR%\temp\cab61.tmp
- %WINDIR%\temp\tar3.tmp
- %WINDIR%\temp\cab2.tmp
- %WINDIR%\temp\tare8f8.tmp
- %WINDIR%\temp\cabe8f7.tmp
- nul
- %WINDIR%\temp\cabb4ca.tmp
- %WINDIR%\temp\tarb4cb.tmp
Deletes the following files
- %WINDIR%\temp\cabe8f7.tmp
- %WINDIR%\temp\tar7192.tmp
- %WINDIR%\temp\cab7191.tmp
- %WINDIR%\temp\tar5b91.tmp
- %WINDIR%\temp\cab5b90.tmp
- %WINDIR%\temp\tar5b41.tmp
- %WINDIR%\temp\cab5b40.tmp
- %WINDIR%\temp\tar4493.tmp
- %WINDIR%\temp\cab4492.tmp
- %WINDIR%\temp\tar43d6.tmp
- %WINDIR%\temp\cab43d5.tmp
- %WINDIR%\temp\tar2e32.tmp
- %WINDIR%\temp\cab2e31.tmp
- %WINDIR%\temp\tar2de2.tmp
- %WINDIR%\temp\cab2de1.tmp
- %WINDIR%\temp\tar17c1.tmp
- %WINDIR%\temp\cab17c0.tmp
- %WINDIR%\temp\tar1790.tmp
- %WINDIR%\temp\cab178f.tmp
- %WINDIR%\temp\tar1750.tmp
- %WINDIR%\temp\cab174f.tmp
- %WINDIR%\temp\tar1664.tmp
- %WINDIR%\temp\cab1663.tmp
- %WINDIR%\temp\tar62.tmp
- %WINDIR%\temp\cab61.tmp
- %WINDIR%\temp\tar3.tmp
- %WINDIR%\temp\cab2.tmp
- %WINDIR%\temp\tare8f8.tmp
- %WINDIR%\temp\cabb4ca.tmp
- %WINDIR%\temp\tarb4cb.tmp
Moves itself
- from <Full path to file> to <Current directory>\o3xm9p47t6d2l4fli.exe
Network activity
Connects to
- 'localhost':49188
- 'localhost':49190
- 'ke##uth.win':443
- 'x1.#.lencr.org':80
- 'x2.#.lencr.org':80
TCP
HTTP GET requests
- http://x1.#.lencr.org/
- http://x2.#.lencr.org/
Other
- 'localhost':49188
- 'localhost':49190
- 'localhost':49191
- 'ke##uth.win':443
UDP
- DNS ASK ke##uth.win
- DNS ASK x1.#.lencr.org
- DNS ASK x2.#.lencr.org
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\rename_and_restart.bat" "' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\rename_and_restart.bat" "
- '<SYSTEM32>\timeout.exe' /t 2 /nobreak
- '<SYSTEM32>\cmd.exe' /c certutil -hashfile "<Current directory>\o3xM9p47t6D2L4fLI.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
- '<SYSTEM32>\certutil.exe' -hashfile "<Current directory>\o3xM9p47t6D2L4fLI.exe" MD5
- '<SYSTEM32>\find.exe' /i /v "md5"
- '<SYSTEM32>\find.exe' /i /v "certutil"
