Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /im <!DOCTYPE
- '<SYSTEM32>\taskkill.exe' /f /im </div>
- '<SYSTEM32>\taskkill.exe' /f /im
- '<SYSTEM32>\taskkill.exe' /f /im <div
- '<SYSTEM32>\taskkill.exe' /f /im <body>
- '<SYSTEM32>\taskkill.exe' /f /im </head>
- '<SYSTEM32>\taskkill.exe' /f /im </style>
- '<SYSTEM32>\taskkill.exe' /f /im -->
- '<SYSTEM32>\taskkill.exe' /f /im .content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}
- '<SYSTEM32>\taskkill.exe' /f /im #content{margin:0
- '<SYSTEM32>\taskkill.exe' /f /im background-color:#555555;}
- '<SYSTEM32>\taskkill.exe' /f /im </body>
- '<SYSTEM32>\taskkill.exe' /f /im #header{width:96%;margin:0
- '<SYSTEM32>\taskkill.exe' /f /im h2{font-size:1.7em;margin:0;color:#CC0000;}
- '<SYSTEM32>\taskkill.exe' /f /im h1{font-size:2.4em;margin:0;color:#FFF;}
- '<SYSTEM32>\taskkill.exe' /f /im fieldset{padding:0
- '<SYSTEM32>\taskkill.exe' /f /im body{margin:0;font-size:.7em;font-family:Verdana,
- '<SYSTEM32>\taskkill.exe' /f /im <!--
- '<SYSTEM32>\taskkill.exe' /f /im <style
- '<SYSTEM32>\taskkill.exe' /f /im <title>404
- '<SYSTEM32>\taskkill.exe' /f /im <meta
- '<SYSTEM32>\taskkill.exe' /f /im <head>
- '<SYSTEM32>\taskkill.exe' /f /im <html
- '<SYSTEM32>\taskkill.exe' /f /im h3{font-size:1.2em;margin:10px
- '<SYSTEM32>\taskkill.exe' /f /im </html>
Modifies file system
Creates the following files
- <SYSTEM32>\wpd.xml
- <SYSTEM32>\wpd1.xml
Network activity
TCP
HTTP GET requests
- http://10#.#13.246.23/wpd/wpd.txt
- http://10#.#13.246.23/wpd/kill.html
- http://10#.#13.246.23/wpd/test.html
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\taskkill.exe' /f /im <!DOCTYPE' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /f /im </div>' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /f /im' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /f /im <div' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /f /im <body>' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /f /im </head>' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /f /im </style>' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /f /im -->' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /f /im .content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /f /im #content{margin:0' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /f /im background-color:#555555;}' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /f /im </body>' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /f /im #header{width:96%;margin:0' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /f /im h2{font-size:1.7em;margin:0;color:#CC0000;}' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /f /im h1{font-size:2.4em;margin:0;color:#FFF;}' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /f /im fieldset{padding:0' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /f /im body{margin:0;font-size:.7em;font-family:Verdana,' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /f /im <!--' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /f /im <style' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /f /im <title>404' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /f /im <meta' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /f /im <head>' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /f /im <html' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /f /im h3{font-size:1.2em;margin:10px' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /f /im </html>' (with hidden window)
