live casino online

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

F¨¹hrt Befehle eines externen, b?swilligen Benutzers aus, wodurch das betroffene System gef?hrdet wird. Verbindet sich mit einer Website, um Daten zu versenden und zu empfangen.

?bertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

F¨¹gt die folgenden Mutexe hinzu, damit nur jeweils eine ihrer Kopien ausgef¨¹hrt wird:

• ff3SRBIN5xkUxioy

Backdoor-Routine

F¨¹hrt die folgenden Befehle eines externen, b?swilligen Benutzers aus:

• pong - Sends a "pong" string to the C2
• rec - Restarts the application
• CLOSE - Closes the application
• uninstall - Executes the uninstall commands
• update - Executes the uninstall commands and the updated binary
• DW - Executes a powershell script
• FM - Executes a command from the C2 in memory
• LN - Downloads a file from a URL and execute it.
• Urlopen - Opens a URL through a browser
• Urlhide - Creates a HTTP GET request
• PCShutdown - Executes a shutdown command
• PCRestart - Executes a restart command
• PCLogoff - Executes a logoff command
• RunShell - Executes a command
• StartDDos - Initiates DDoS activities
• StopDDos - Terminates DDoS activities
• StartReport - Sends a list of running processes
• StopReport - Terminates sending of running proccesses list
• Xchat - Sends a "Xchat" string and the ID generated using system information
• Hosts - Sends the drivers\etc\host file contents
• Shosts - Modifies the contents of a file
• DDos - Sends a "DDos" string to the C2
• plugin - Decompresses and executes a plugin
• savePlugin - Saves the decoded plugin to a registry then decompresses and executes it
• RemovePlugins - Deletes the registry with plugin data
• OfflineGet - Sends a "OfflineKeylogger Not Enabled" string to the C2
• $Cap - Sends a screen capture

Verbindet sich mit den folgenden Websites, um Daten zu versenden und zu empfangen.

• using TCP:
  • {BLOCKED}.{BLOCKED}.{BLOCKED}.34:4444

Datendiebstahl

Folgende Daten werden gesammelt:

• Processor count
• Username
• Computer name
• OS version and architecture
• Hard drive size of system drive
• Malware's last modification date
• If executed using the filename "USB.exe"
• If executed with admin rights
• Webcam availability
• CPU Information
• GPU Information
• RAM Information
• Antivirus product name