Technical Information
Malicious functions
Creates and executes the following (exploit)
- '%APPDATA%\hjc.exe'
Modifies file system
Creates the following files
- %APPDATA%\hjc.exe
- %TEMP%\halvernes\prelegate\udraderedes.fas
- %TEMP%\halvernes\prelegate\blomkaalshovedets.ana
- %TEMP%\halvernes\prelegate\troglyt121.mah
- %TEMP%\halvernes\prelegate\excystation.txt
- %TEMP%\halvernes\prelegate\handelsraadene\husassistent.xav
- %TEMP%\halvernes\prelegate\handelsraadene\sjlespalterne.ter
- %TEMP%\nsh44be.tmp
- %TEMP%\nsm4970.tmp\system.dll
- %TEMP%\nsc4981.tmp
- %TEMP%\nsw4d58.tmp
- %TEMP%\nsm5297.tmp
- %TEMP%\nsr56ad.tmp
Deletes the following files
- %TEMP%\nsh44be.tmp
- %TEMP%\nsc4981.tmp
- %TEMP%\nsw4d58.tmp
- %TEMP%\nsm5297.tmp
Network activity
Connects to
- 'ya####wakened.shop':80
- '19#.#2.81.162':80
TCP
HTTP GET requests
- http://www.ya####wakened.shop/bj
- http://19#.#2.81.162/xampp/gvc/beautifulgirlwantottakeapicturewithmebecauseshebelievinguantgenabusrugtoersibbecasueshewant___suchaxwithmeshe.doc
- http://19#.#2.81.162/30333/hjc.exe
UDP
- DNS ASK ya####wakened.shop
Miscellaneous
Executes the following
- '%ProgramFiles%\microsoft office\office14\winword.exe' -Embedding
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
