RE:SOLD OUT factory price for 1T ,2.8NM and 1.4T 28th will be on selling

[colorfulbit]

Hi everybody
This is michelle again
We have a news,IC price is going up during these days.
1.20th,25th goods are sold out and finished to promotion.
2.26th will be pushed into market,1.4T will instead of 1T items...
Price has been changed,if you have concern,pls write email to me or talk to me on skype.
We will reply you ASAP,for time is money
My contact as below
E-M:2803722847@qq.com
My QQ:2803722847
SKYPE:colorfulbit

[studio1one]

I spoke to Michelle on Skype.

She sent me a file purporting to be a PDF

The file was actually a .scr executable.

After exploring the exectuable with notepad++ I found the following


InstallPath="%APPDATA%\\Microsoft\\Windows\\System32"
RunProgram="hidcon:Run.bat"

This is designed to run a hidden batch file on start up

A quick google will tell you I am right


https://www.google.co.uk/search?q=InstallPath%3D%22%25APPDATA%25%5C%5CMicrosoft%5C%5CWindows%5C%5CSystem32%22RunProgram%3D%22hidcon%3ARun.bat%22&rlz=1C1FDUM_enGB486GB486&oq=InstallPath%3D%22%25APPDATA%25%5C%5CMicrosoft%5C%5CWindows%5C%5CSystem32%22RunProgram%3D%22hidcon%3ARun.bat%22&aqs=chrome..69i57.958j0j4&sourceid=chrome&espv=210&es_sm=93&ie=UTF-8#q=Windows%5C%5CSystem32%22RunProgram%3D%22hidcon%3ARun.bat%22&safe=off


and

<assemblyIdentity version="1.4.1.2100" name="7-Zip.SfxMod" type="win32"></assemblyIdentity>

7zip FX mod is a trojan

https://www.virustotal.com/en/file/95d3ee7541202ac8e7313623cc32e5c47f675be0488e1a7255d33baa32025374/analysis/


This user is not to be trusted.