Technical Information
Malicious functions
Creates and executes the following
- '' (downloaded from the Internet)
Creates and executes the following (exploit)
- 'C:\users\public\vbc.exe'
Modifies file system
Creates the following files
- C:\users\public\vbc.exe
- %TEMP%\undergaaedes.ini
- %TEMP%\nsi621d.tmp\system.dll
- %TEMP%\stereograph.wad
- %TEMP%\airplane_14.bmp
- %TEMP%\system.net.quic.dll
- %TEMP%\folder-drag-accept-symbolic.symbolic.png
- %TEMP%\baglommerne127.ini
- %TEMP%\euda.lnk
Network activity
Connects to
- '10#.#49.13.182':80
TCP
HTTP GET requests
- http://10#.#49.13.182/data2cloud/.svchost.exe
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: ''
Executes the following
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
