Technical Information
Malicious functions
Creates and executes the following
- '' (downloaded from the Internet)
Creates and executes the following (exploit)
- 'C:\users\public\vbc.exe'
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v2.0.50727\installutil.exe
the following user processes:
- vbc.exe
Modifies file system
Creates the following files
- C:\users\public\vbc.exe
- %APPDATA%\microsoft\windows\templates\sqlite3.zip
- %APPDATA%\Microsoft\windows\templates\sqlite3\sqlite3.dll
- %APPDATA%\Microsoft\windows\templates\sqlite3\sqlite3_stdcall.dll
- %APPDATA%\microsoft\windows\templates\login data
Deletes the following files
- %APPDATA%\microsoft\windows\templates\sqlite3.zip
- %APPDATA%\microsoft\windows\templates\login data
Substitutes the following files
- %APPDATA%\microsoft\windows\templates\login data
Network activity
Connects to
- '19#.#10.214.144':80
Miscellaneous
Executes the following
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
- '%WINDIR%\microsoft.net\framework\v2.0.50727\installutil.exe'
