Technical Information
Malicious functions
Creates and executes the following (exploit)
- '%TEMP%\ibm_centisisi.exe'
Modifies file system
Creates the following files
- %TEMP%\ibm_centisisi.exe
- %TEMP%\nsf531f.tmp
- %APPDATA%\microsoft\windows\start menu\encolors\forbedringens\wha.rea
- %APPDATA%\microsoft\windows\start menu\encolors\forbedringens\forlbent\folkloristisk\dagtemperaturerne\refrnsangernes\affdende.smk
- %APPDATA%\microsoft\windows\start menu\encolors\forbedringens\forlbent\folkloristisk\dagtemperaturerne\refrnsangernes\morgenfruernes.teg
- %TEMP%\nsp5571.tmp\system.dll
Network activity
Connects to
- '19#.#.26.168':80
TCP
HTTP GET requests
- http://19#.#.26.168/90/winBx.exe
Miscellaneous
Executes the following
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
