Technical Information
Malicious functions
Creates and executes the following
- '' (downloaded from the Internet)
Modifies file system
Creates the following files
- <Current directory>\jpeg62.dll
- <Current directory>\tiparadio.exe
- <Current directory>\tiparadio10.exe
- <Current directory>\sdr.pswd
- <Current directory>\initnew.bin
- <Current directory>\zlib1.dll
- <Current directory>\ver.txt
- <Current directory>\ub6lft.exe
- <Current directory>\key.dll
- <Current directory>\genalrm.wav
- <Current directory>\v.exe
- C:\users\public\kjgfd
- <Current directory>\ser
Deletes the following files
- <Current directory>\ver.txt
Network activity
Connects to
- '18#.#21.154.39':8067
- '18#.#21.154.39':8022
TCP
HTTP GET requests
- http://18#.##1.154.39:8067/jpeg62 via 18#.#21.154.39
- http://18#.##1.154.39:8067/tiparadio via 18#.#21.154.39
- http://18#.##1.154.39:8067/tiparadio10 via 18#.#21.154.39
- http://18#.##1.154.39:8067/ver.txt via 18#.#21.154.39
- http://18#.##1.154.39:8067/UB6LFT via 18#.#21.154.39
- http://18#.##1.154.39:8067/key via 18#.#21.154.39
- http://18#.##1.154.39:8067/genalrm.wav via 18#.#21.154.39
- http://18#.##1.154.39:8067/v via 18#.#21.154.39
Other
- '18#.#21.154.39':8022
Miscellaneous
Searches for the following windows
- ClassName: 'signalRadioSharm<Current directory>' WindowName: ''
- ClassName: 'My Window Class WEBCAM!' WindowName: ''
Creates and executes the following
- '<Current directory>\tiparadio.exe'
