Technical Information
Modifies file system
Sets the 'hidden' attribute to the following files
- %TEMP%\iqbasi
Moves the following files
- from <Full path to file> to %TEMP%\tkcldy
Substitutes the following executable files
- <Full path to file>
Moves itself
- from <Full path to file> to %TEMP%\iqbasi
Network activity
Connects to
- '14#.#5.72.240':5525
TCP
Other
- '14#.#5.72.240':5525
Miscellaneous
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /c powershell.exe -NoProfile -ExecutionPolicy Bypass -Command ^"^& { $encoded = 'QXBwIGluaXRpYWxpemF0aW9uIGVycm9yIDB4MTAz'; $text = [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64S...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command "& { $encoded = 'QXBwIGluaXRpYWxpemF0aW9uIGVycm9yIDB4MTAz'; $text = [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($encoded)); $t...
