Technical Information
Modifies file system
Modifies the HOSTS file.
Network activity
TCP
- 'wf###agon.ru':443
- 's1.##sdragon.ru':5222
UDP
- DNS ASK s1.##sdragon.ru
- DNS ASK wf###agon.ru
- DNS ASK cd#.##sdragon.ru
Miscellaneous
Adds a root certificate
Creates and executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name=all remoteip="88.212.247.4/31"' (with hidden window)
- '%WINDIR%\syswow64\route.exe' delete 88.212.247.4/31' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name=all remoteip="37.230.228.80/31"' (with hidden window)
- '%WINDIR%\syswow64\route.exe' delete 37.230.228.80/31' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name=all remoteip="92.53.96.128/31"' (with hidden window)
- '%WINDIR%\syswow64\route.exe' delete 92.53.96.128/31' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name=all remoteip="5.183.155.130/31"' (with hidden window)
- '%WINDIR%\syswow64\route.exe' delete 5.183.155.130/31' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name=all remoteip="37.230.228.208/31"' (with hidden window)
- '%WINDIR%\syswow64\route.exe' delete 37.230.228.208/31' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name=all remoteip="88.212.247.4/31"
- '%WINDIR%\syswow64\route.exe' delete 88.212.247.4/31
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name=all remoteip="37.230.228.80/31"
- '%WINDIR%\syswow64\route.exe' delete 37.230.228.80/31
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name=all remoteip="92.53.96.128/31"
- '%WINDIR%\syswow64\route.exe' delete 92.53.96.128/31
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name=all remoteip="5.183.155.130/31"
- '%WINDIR%\syswow64\route.exe' delete 5.183.155.130/31
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name=all remoteip="37.230.228.208/31"
- '%WINDIR%\syswow64\route.exe' delete 37.230.228.208/31