Technical Information
Malicious functions:
Creates and executes the following:
- '<SYSTEM32>\wscript.exe' "%TEMP%\2fb888b6-0dcc-433e-a45f-e03690869195\1196438181.vbs"
- '%TEMP%\91db6816-61f0-460f-b633-6b691077ee06.exe'
- '%APPDATA%\WipeShadow.exe'
Executes the following:
- '<SYSTEM32>\cmd.exe' /K "%APPDATA%\WipeShadow.exe"
- '<SYSTEM32>\reg.exe' reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "91db6816-61f0-460f-b633-6b691077ee06" /t REG_SZ /d "%APPDATA%\WipeShadow.exe" & exit
Injects code into
the following user processes:
- WipeShadow.exe
Modifies file system:
Creates the following files:
- %APPDATA%\23EF5514-3059-436F-A4A7-4CEFAAB20EB1\run.dat
- %TEMP%\91db6816-61f0-460f-b633-6b691077ee06.exe
- %APPDATA%\WipeShadow.exe
Deletes the following files:
- %TEMP%\2fb888b6-0dcc-433e-a45f-e03690869195\1196438181.vbs
Network activity:
Connects to:
- 'py##.#ublicvm.com':5182
UDP:
- DNS ASK py##.#ublicvm.com
