Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\microsoft update.lnk
Modifies file system
Creates the following files
- %TEMP%\auteb57.tmp
- %TEMP%\esdpwfr
- %TEMP%\autf769.tmp
- %TEMP%\xuryol.pdf
- %TEMP%\skyp\naca.exe
Deletes the following files
- %TEMP%\auteb57.tmp
- %TEMP%\esdpwfr
- %TEMP%\autf769.tmp
Network activity
Connects to
- 'ru###.ddns.net':81
UDP
- DNS ASK ru###.ddns.net
Miscellaneous
Executes the following
- '%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32.exe' "%TEMP%\XURYOL.pdf"
