Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c ping 127.0.0.1 -n 10 > nul & start C:\Users\Public\document.vbs
Modifies file system
Creates the following files
- nul
Network activity
Connects to
- '4s##c.com':443
- 'cr#.#odaddy.com':80
TCP
HTTP GET requests
- http://cr#.#odaddy.com/gdroot.crl
- http://cr#.#odaddy.com/gdroot-g2.crl
- http://cr#.#odaddy.com/gdig2s1-5357.crl
Other
- '4s##c.com':443
UDP
- DNS ASK 4s##c.com
- DNS ASK cr#.#odaddy.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c ping 127.0.0.1 -n 10 > nul & start C:\Users\Public\document.vbs' (with hidden window)
Executes the following
- '<SYSTEM32>\ping.exe' 127.0.0.1 -n 10
