Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\cmd.exe' /d /c cmd /d /c cmd /d /c del <Full path to file>
- '<SYSTEM32>\ping.exe' 1.1.1.1 -n 1 -w 3000
- '<SYSTEM32>\cmd.exe' /d /c del <Full path to file>
- '<SYSTEM32>\cmd.exe' /d /c cmd /d /c del <Full path to file>
- '<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del <Full path to file>
- '<SYSTEM32>\cmd.exe' /d /c TIMEOUT 3 & cmd /d /c cmd /d /c cmd /d /c cmd /d /c cmd /d /c del <Full path to file>
- '<SYSTEM32>\cmd.exe' /d /c cmd /d /c cmd /d /c cmd /d /c del <Full path to file>
- '<SYSTEM32>\cmd.exe' /d /c cmd /d /c cmd /d /c cmd /d /c cmd /d /c del <Full path to file>
Modifies file system:
Deletes itself.
Network activity:
Connects to:
- 'd3#######z2l8y.cloudfront.net':80
TCP:
HTTP GET requests:
- http://d3#######z2l8y.cloudfront.net/p.ashx?e=###################################################################################################################################################...
UDP:
- DNS ASK d3#######z2l8y.cloudfront.net
