Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\net.exe' stop foundation
Modifies file system
Creates the following files
- nul
Deletes itself.
Network activity
Connects to
- '19#.#23.245.185':80
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\net.exe' group /domain' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C net.exe stop foundation' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C sc delete foundation' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c del <Full path to file> >> NUL' (with hidden window)
Executes the following
- '<SYSTEM32>\net.exe' group /domain
- '<SYSTEM32>\net1.exe' group /domain
- '<SYSTEM32>\cmd.exe' /C net.exe stop foundation
- '<SYSTEM32>\cmd.exe' /C sc delete foundation
- '<SYSTEM32>\net1.exe' stop foundation
- '<SYSTEM32>\sc.exe' delete foundation
- '<SYSTEM32>\cmd.exe' /c del <Full path to file> >> NUL
