Technical Information
Malicious functions
Creates and loads libraries (exploit)
- %APPDATA%\microsoft\windows\templates\libconfig2.dll
Modifies file system
Creates the following files
- %HOMEPATH%\application data\microsoft\forms\excel.box
- %TEMP%\vb9bdc.tmp
- %TEMP%\vb9c9b.tmp
- %TEMP%\vb9cad.tmp
- %TEMP%\vb9cc0.tmp
- %TEMP%\5d9f0000
- %TEMP%\mannual.xlsx.zip
- %TEMP%\oleobject1.bin
- %APPDATA%\microsoft\windows\templates\libconfig2.dll
Deletes the following files
- %TEMP%\vb9bdb.tmp
- %TEMP%\vb9c9a.tmp
- %TEMP%\vb9cac.tmp
- %TEMP%\vb9cbf.tmp
Moves the following files
- from %TEMP%\vb9bdc.tmp to %TEMP%\vb9bdb.tmp
- from %TEMP%\vb9c9b.tmp to %TEMP%\vb9c9a.tmp
- from %TEMP%\vb9cad.tmp to %TEMP%\vb9cac.tmp
- from %TEMP%\vb9cc0.tmp to %TEMP%\vb9cbf.tmp
- from %TEMP%\5d9f0000 to %TEMP%\mannual.xlsx
Network activity
Connects to
- 'mi###store.com':443
UDP
- DNS ASK mi###store.com
