Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name=Malwarebytes program="%ProgramFiles%\Malwarebytes\Anti-Malware\MBAMService.exe" remoteip=52.87.4.37,54.87.176.164 dir=out action=block
Modifies file system:
Creates the following files:
- %TEMP%\aut1.tmp
- <Current directory>\%ProgramData%\MB2Migration\Configuration\license.conf
Deletes the following files:
- %TEMP%\aut1.tmp
Modifies the HOSTS file.
Miscellaneous:
Executes the following:
- '<SYSTEM32>\cmd.exe' /c netsh advfirewall firewall delete rule name=Malwarebytes dir=out
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name=Malwarebytes dir=out
- '<SYSTEM32>\cmd.exe' /c netsh advfirewall firewall add rule name=Malwarebytes program="%ProgramFiles%\Malwarebytes\Anti-Malware\MBAMService.exe" remoteip=52.87.4.37,54.87.176.164 dir=out action=block
