Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %WINDIR%\tasks\gamer.bat
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c %WINDIR%\Tasks\gamer.bat
Network activity
Connects to
- '<LOCALNET>.49.62':80
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c %WINDIR%\Tasks\gamer.bat' (with hidden window)
Executes the following
- '<SYSTEM32>\certutil.exe' -decode %WINDIR%\Tasks\GamerGame.txt %WINDIR%\Tasks\GamerGame.exe
- '<SYSTEM32>\certutil.exe' -decode %WINDIR%\Tasks\GamingGamer.txt %WINDIR%\Tasks\System.Management.Automation.dll
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\installutil.exe' /logfile= /LogToConsole=true /U %WINDIR%\Tasks\GamerGame.exe
