Technical Information
Malicious functions
Creates and executes the following (exploit)
- '%TEMP%\ibm_centisis.exe'
Injects code into
the following user processes:
- ibm_centisis.exe
Modifies file system
Creates the following files
- %TEMP%\ibm_centisis.exe
- %TEMP%\nsq5feb.tmp
- %TEMP%\kyolsxzvbfu.sif
- %TEMP%\nsw60a8.tmp\jdmet.dll
Network activity
Connects to
- '10#.#75.202.150':80
TCP
HTTP GET requests
- http://10#.#75.202.150/55/win32.exe
Miscellaneous
Executes the following
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
