Technical Information
Modifies file system
Creates the following files
- %WINDIR%\temp\cab956b.tmp
- %WINDIR%\temp\cab9ffa.tmp
- %WINDIR%\temp\tar9ffb.tmp
- %WINDIR%\temp\caba089.tmp
- %WINDIR%\temp\tara08a.tmp
- %WINDIR%\temp\caba165.tmp
- %WINDIR%\temp\tara166.tmp
- %WINDIR%\temp\caba1a6.tmp
- %WINDIR%\temp\tara1a7.tmp
- %WINDIR%\temp\caba2c0.tmp
- %WINDIR%\temp\tara2c1.tmp
- %WINDIR%\temp\caba7f0.tmp
- %WINDIR%\temp\tara7f1.tmp
- %WINDIR%\temp\caba840.tmp
- %WINDIR%\temp\tara841.tmp
- %WINDIR%\temp\caba93c.tmp
- %WINDIR%\temp\tar9a3f.tmp
- %WINDIR%\temp\tara93d.tmp
- %WINDIR%\temp\cab9a3e.tmp
- %WINDIR%\temp\cab9981.tmp
- %WINDIR%\temp\tar956c.tmp
- %WINDIR%\temp\cab9667.tmp
- %WINDIR%\temp\tar9668.tmp
- %WINDIR%\temp\cab96e6.tmp
- %WINDIR%\temp\tar96e7.tmp
- %WINDIR%\temp\cab9716.tmp
- %WINDIR%\temp\tar9717.tmp
- %WINDIR%\temp\cab9757.tmp
- %WINDIR%\temp\tar9758.tmp
- %WINDIR%\temp\cab9814.tmp
- %WINDIR%\temp\tar9815.tmp
- %WINDIR%\temp\cab9864.tmp
- %WINDIR%\temp\tar9865.tmp
- %WINDIR%\temp\cab9940.tmp
- %WINDIR%\temp\tar9941.tmp
- %WINDIR%\temp\tar9982.tmp
- nul
Deletes the following files
- %WINDIR%\temp\cab956b.tmp
- %WINDIR%\temp\tar9ffb.tmp
- %WINDIR%\temp\caba089.tmp
- %WINDIR%\temp\tara08a.tmp
- %WINDIR%\temp\caba165.tmp
- %WINDIR%\temp\tara166.tmp
- %WINDIR%\temp\tar9a3f.tmp
- %WINDIR%\temp\cab9ffa.tmp
- %WINDIR%\temp\caba1a6.tmp
- %WINDIR%\temp\tara2c1.tmp
- %WINDIR%\temp\caba7f0.tmp
- %WINDIR%\temp\tara7f1.tmp
- %WINDIR%\temp\caba840.tmp
- %WINDIR%\temp\tara841.tmp
- %WINDIR%\temp\tara1a7.tmp
- %WINDIR%\temp\caba2c0.tmp
- %WINDIR%\temp\cab9a3e.tmp
- %WINDIR%\temp\tar9982.tmp
- %WINDIR%\temp\cab9981.tmp
- %WINDIR%\temp\cab9667.tmp
- %WINDIR%\temp\tar9668.tmp
- %WINDIR%\temp\cab96e6.tmp
- %WINDIR%\temp\tar96e7.tmp
- %WINDIR%\temp\cab9716.tmp
- %WINDIR%\temp\tar9717.tmp
- %WINDIR%\temp\tar956c.tmp
- %WINDIR%\temp\cab9757.tmp
- %WINDIR%\temp\cab9814.tmp
- %WINDIR%\temp\tar9815.tmp
- %WINDIR%\temp\cab9864.tmp
- %WINDIR%\temp\tar9865.tmp
- %WINDIR%\temp\cab9940.tmp
- %WINDIR%\temp\tar9941.tmp
- %WINDIR%\temp\tar9758.tmp
- %WINDIR%\temp\caba93c.tmp
- %WINDIR%\temp\tara93d.tmp
Deletes itself.
Network activity
Connects to
- 'cd#.##scordapp.com':443
- 'ap#.#y-ip.io':443
- 'x1.#.lencr.org':80
- 'r3.#.lencr.org':80
- 'di##ord.com':443
- 'ra###cheats.xyz':443
- 'pk#.goog':80
TCP
HTTP GET requests
- http://x1.#.lencr.org/
- http://r3.#.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgQnF3gl1j6ulAzj6t5rkcy23A%3D%3D
- http://pk#.goog/gsr1/gsr1.crt
Other
- 'cd#.##scordapp.com':443
- 'ap#.#y-ip.io':443
- 'di##ord.com':443
- 'ra###cheats.xyz':443
UDP
- DNS ASK cd#.##scordapp.com
- DNS ASK ap#.#y-ip.io
- DNS ASK x1.#.lencr.org
- DNS ASK r3.#.lencr.org
- DNS ASK di##ord.com
- DNS ASK ra###cheats.xyz
- DNS ASK pk#.goog
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /c cls
- '<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "<Full path to file>"
- '<SYSTEM32>\ping.exe' 1.1.1.1 -n 1 -w 3000
