Technical Information
Malicious functions
Creates and executes the following
- '' (downloaded from the Internet)
Creates and executes the following (exploit)
- 'C:\users\public\vbc.exe'
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
the following user processes:
- vbc.exe
Modifies file system
Creates the following files
- C:\users\public\vbc.exe
Deletes the following files
- C:\users\public\vbc.exe
Network activity
Connects to
- '18.##4.54.219':80
- 'he####yfifties.com':80
- 'ac##r.com':80
- 'wm###uezy.com':80
- 'th####yfriendly.com':80
- 'jo###ono.com':80
- 'de####nwheeeles.com':80
- 'ri##vd.com':80
TCP
HTTP GET requests
- http://www.cu#####erstories.com/bw82/?1b####################################################################################
UDP
- DNS ASK ch####ubser.digital
- DNS ASK he####yfifties.com
- DNS ASK ac##r.com
- DNS ASK wm###uezy.com
- DNS ASK th####yfriendly.com
- DNS ASK jo###ono.com
- DNS ASK de####nwheeeles.com
- DNS ASK ri##vd.com
- DNS ASK cu#####erstories.com
- DNS ASK yj##s.com
Miscellaneous
Executes the following
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
- '%WINDIR%\syswow64\wininit.exe'
- '%WINDIR%\syswow64\cmd.exe' del "C:\Users\Public\vbc.exe"
