Technical Information
Modifies file system
Creates the following files
- %TEMP%\<File name>.exe
Network activity
UDP
- DNS ASK microsoft.com
- DNS ASK au##.#mbspoofer.xyz
- DNS ASK au##.#widspoof.me
Miscellaneous
Creates and executes the following
- '%TEMP%\<File name>.exe' 1 "<Full path to file>"
Executes the following
- '%WINDIR%\syswow64\netsh.exe' interface ipv6 add dnsservers name="Ethernet 2" address=2606:4700:4700::1111 index=1
- '%WINDIR%\syswow64\netsh.exe' interface ipv6 add dnsservers name="Ethernet 2" address=2001:4860:4860::8888 index=0
- '%WINDIR%\syswow64\netsh.exe' interface ipv6 add dnsservers name="Ethernet 2" address=2606:4700:4700::1111 index=1' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' interface ipv6 add dnsservers name="Ethernet 2" address=2001:4860:4860::8888 index=0' (with hidden window)
