Technical Information
Malicious functions
Downloads
- https://cdn.discordapp.com/attachments/1186313996668784691/1189710892712083476/crackme.exe?ex=659f279c&is=658cb29c&hm=f88b093d718437bd96bb456e34beacfe2e7a8c68f9e662edba48572cd734a4de& as %temp%\crackme.exe
Modifies file system
Creates the following files
- %TEMP%\ixp000.tmp\idkobf.bat
- nul
- %TEMP%\ixp000.tmp\tmp
Deletes the following files
- %TEMP%\ixp000.tmp\tmp
Substitutes the following files
- %TEMP%\ixp000.tmp\tmp
Network activity
Connects to
- 'cd#.##scordapp.com':443
TCP
Other
- 'cd#.##scordapp.com':443
UDP
- DNS ASK cd#.##scordapp.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c idkobf.bat' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c idkobf.bat
- '<SYSTEM32>\chcp.com' 437
- '<SYSTEM32>\find.exe'
- '<SYSTEM32>\findstr.exe' /L /I set idkobf.bat
- '<SYSTEM32>\findstr.exe' /L /I goto idkobf.bat
- '<SYSTEM32>\findstr.exe' /L /I echo idkobf.bat
- '<SYSTEM32>\findstr.exe' /L /I pause idkobf.bat
- '<SYSTEM32>\cmd.exe' /c type tmp
