Technical Information
Modifies file system
Creates the following files
- %TEMP%\ixp000.tmp\theoryabiility.exe
- %TEMP%\ixp000.tmp\theoryability.exe
- %LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\theoryability.exe.log
- %TEMP%\content\3236-916-theoryabiility.exe-19-51-46-729.dump
- %TEMP%\content\3236-916-theoryabiility.exe-19-51-48-794.dump
- %TEMP%\content\3236-916-theoryabiility.exe-19-51-49-375.dump
Network activity
Connects to
- 'fi###.catbox.moe':443
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/CABD2A79A1076A31F21D253635CB039D4329A5E8.crt?9a##############
Other
- 'fi###.catbox.moe':443
UDP
- DNS ASK fi###.catbox.moe
Miscellaneous
Creates and executes the following
- '%TEMP%\ixp000.tmp\theoryability.exe'
- '%TEMP%\ixp000.tmp\theoryabiility.exe'
- '%TEMP%\ixp000.tmp\theoryability.exe' ' (with hidden window)
- '%TEMP%\ixp000.tmp\theoryabiility.exe' ' (with hidden window)
Executes the following
- '<SYSTEM32>\certreq.exe'
