SHA1:
- c0895d0123a92f56db2940df44042e102b77e47d
Description
Malicious VBScript application for Windows that acts as a backdoor.
Operating routine
Downloads and executes https://asobimo[.]link/ubr.txt (6d8716cddc3ca6c8558eb4f842d81638f00f01f8), which is a PowerShell script, that prepares the system for the installation of the Trojan.BtcMine.2742 miner.
Sends a POST request to http://microduck3.duckdns[.]org:408.
Receives the following commands in response:
| Command | Description |
|---|---|
| exc | Launch script from [argument 1] |
| Sc | Write [argument 1] to %TEMP%/[argument 2] and launch it in minimized window |
| Rf | Write [argument 1] to %TEMP%/ [argument 2] and launch it in hidden window |
| Ren | Overwrite the current version of the script with [argument 1] |
| Up | Launch payload from server using wscript.exe |
| Un | Launch a script from the server with arguments containing the full path to this script and file name |
| Cl | Terminate backdoor |
Mitre Matrix
| Stage | Tactic |
|---|---|
| Execution | Command and Scripting Interpreter (T1059) Visual Basic (T1059.005) |
| Command and Control | Application Layer Protocol (T1071) Web Protocols (T1071.001) DNS (T1071.004) Data Obfuscation (T1001) Protocol or Service Impersonation (T1001.003) |
