Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- Creates
- C:\Users\<username>\AppData\Roaming\<flashplayer and sun have been observed)\<characters>.exe
- Creates:
- C:\Users\<username>\AppData\Local\Temp\upd[0-1a-z{8}.bat
- @echo off
- :d
- del /F /Q "C:\Users\<username>\AppData\Local\Temp\<filename>.exe"
- if exist "C:\Users\<username>\AppData\Local\Temp\<filename>.exe" goto d
- del /F "C:\Users\<username>\AppData\Local\Temp\upd[0-1a-z{8}.bat"
- Creates several Reg keys like below:
- HKEY_CURRENT_USER\Software\Microsoft\[A-Za-z]{4,6}
- Creates one reg key with subkey like below:
- HKEY_CURRENT_USER\Software\Microsoft\<windows item>\[A-za-z}{4,10}
- Creates method of persistence key:
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\<characters>.exe
- Mutex
- Several 32 bit mutex's like:
- 7A12E61582A12DB4D33255EE36EBE129
- Frz_State
- c2 traffic
- https://domain/<rnd>/<rnd>/rnd/
- additional downloads:
- https://domain/<characters>.dat
- https://domain/webinjects.dat
- https://domain/<characters>.exe
- https://domain/grabber.bin
- https://domain/webinject32.bin
- https://domain/vnc32.bin
- https://domain/backsocks.bin
- https://domain/keylogger.bin
Add Comment
Please, Sign In to add comment
