Technical Information
Malicious functions
Creates and executes the following
- '' (downloaded from the Internet)
Creates and executes the following (exploit)
- 'C:\users\public\vbc.exe'
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
the following user processes:
- vbc.exe
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\syswow64\autochk.exe
Modifies file system
Creates the following files
- C:\users\public\vbc.exe
Deletes the following files
- C:\users\public\vbc.exe
Network activity
Connects to
- 're##fs.com':80
- 'st####rzblvd.com':80
- 'po###rauto.pro':80
- 'mi####greens.net':80
TCP
HTTP GET requests
- http://www.in###chpt.com/gqx2/?JT###########################################################################################
UDP
- DNS ASK sn#######qudusissnvx.dns.army
- DNS ASK re##fs.com
- DNS ASK st####rzblvd.com
- DNS ASK in###chpt.com
- DNS ASK po###rauto.pro
- DNS ASK ov###aut.net
- DNS ASK mi####greens.net
- DNS ASK db##dv.com
Miscellaneous
Executes the following
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
- '%WINDIR%\syswow64\msiexec.exe'
- '%WINDIR%\syswow64\cmd.exe' del "C:\Users\Public\vbc.exe"
