Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /im "<File name>.exe" /f
Modifies file system
Deletes itself.
Network activity
Connects to
- '5.##.64.2':80
- 'script.google.com':80
- 'script.google.com':443
- 'pk#.goog':80
- 'sc####.##ogleusercontent.com':443
TCP
HTTP GET requests
- http://5.##.64.2/ip.php
- http://5.##.64.2/api/files/client/s11
- http://5.##.64.2/api/files/client/s12
- http://5.##.64.2/api/files/client/s13
- http://5.##.64.2/api/files/client/s14
- http://script.google.com/macros/s/AKfycbxu6XZln0F2VKs8FMpn924RlKozFV5XZApwvto57voh-zMdTnkCnYo38kxDLRAyW0hb/exec?xf#########################################################
Other
- 'script.google.com':443
- 'sc####.##ogleusercontent.com':443
UDP
- DNS ASK script.google.com
- DNS ASK pk#.goog
- DNS ASK sc####.##ogleusercontent.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /im "<File name>.exe" /f & erase "<Full path to file>" & exit' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /im "<File name>.exe" /f & erase "<Full path to file>" & exit
