Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c ping 127.0.0.1 -n 10 > nul & start C:\Users\Public\document.vbs
Modifies file system
Creates the following files
- nul
Network activity
Connects to
- 'sh###.#etcloudapp.com':443
TCP
Other
- 'sh###.#etcloudapp.com':443
UDP
- DNS ASK sh###.#etcloudapp.com
Miscellaneous
Executes the following
- '<SYSTEM32>\ping.exe' 127.0.0.1 -n 10
- '<SYSTEM32>\cmd.exe' /c ping 127.0.0.1 -n 10 > nul & start C:\Users\Public\document.vbs' (with hidden window)
