Technical Information
Malicious functions
Creates and executes the following
- '' (downloaded from the Internet)
Creates and executes the following (exploit)
- 'C:\users\public\vbc.exe'
Modifies file system
Creates the following files
- C:\users\public\vbc.exe
Network activity
Connects to
- '19#.#10.240.37':80
- 'ab##ongo.cf':80
TCP
HTTP GET requests
- http://19#.#10.240.37/g/pdp.exe
- http://ab##ongo.cf/g/Ilpzv_Tvynzfxj.png
UDP
- DNS ASK ab##ongo.cf
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /C timeout /nobreak /t 19' (with hidden window)
Executes the following
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
- '%WINDIR%\syswow64\cmd.exe' /C timeout /nobreak /t 19
- '%WINDIR%\syswow64\timeout.exe' /nobreak /t 19
