Technical Information
Malicious functions
Creates and executes the following (exploit)
- '%TEMP%\ibm_centos.exe'
Launches a large number of processes
Modifies file system
Creates the following files
- %TEMP%\ibm_centos.exe
- %TEMP%\nsz3350.tmp
- %LOCALAPPDATA%\underkbelser\homam\slangens\uniformer\chikanren.deg
- %LOCALAPPDATA%\underkbelser\homam\slangens\uniformer\duckblind.rad
- %LOCALAPPDATA%\underkbelser\homam\slangens\uniformer\printerfunktionen.ste
- %LOCALAPPDATA%\underkbelser\tilbagekomsternes\contactor\tornirisker\karpe121\greenhead.lej
- %LOCALAPPDATA%\underkbelser\tilbagekomsternes\contactor\tornirisker\karpe121\overnatninger.ove
- %TEMP%\nsj3737.tmp\system.dll
- %TEMP%\nsj3737.tmp\nsexec.dll
Network activity
Connects to
- '19#.#.118.24':80
TCP
HTTP GET requests
- http://19#.#.118.24/36/win32.exe
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c set /a "250^177"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "133^177"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "157^177"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "129^177"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "201^177"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "137^177"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "193^177"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "152^177"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "159^177"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "132^177"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "141^177"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "231^177"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "196^177"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "222^177"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "210^177"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "134^177"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "145^177"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "136^177"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "220^177"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "240^177"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "244^177"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "227^177"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "255^177"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "253^177"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "130^177"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "131^177"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "139^177"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "242^177"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "195^177"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "212^177"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "208^177"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "197^177"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "247^177"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "216^177"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "221^177"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "153^177"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set /a "135^177"' (with hidden window)
Executes the following
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
- '%WINDIR%\syswow64\cmd.exe' /c set /a "157^177"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "129^177"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "201^177"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "137^177"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "193^177"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "152^177"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "242^177"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "159^177"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "141^177"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "231^177"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "196^177"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "222^177"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "210^177"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "134^177"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "145^177"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "133^177"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "220^177"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "153^177"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "240^177"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "244^177"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "227^177"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "255^177"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "253^177"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "130^177"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "131^177"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "136^177"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "132^177"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "139^177"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "212^177"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "208^177"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "197^177"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "247^177"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "216^177"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "221^177"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "250^177"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "195^177"
- '%WINDIR%\syswow64\cmd.exe' /c set /a "135^177"
