Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\net.exe' stop foundation
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\nugets\template_41c318.tmptmpzip7
Deletes itself.
Network activity
Connects to
- '10#.#4.209.178':80
TCP
HTTP GET requests
- http://10#.#4.209.178/02.dat
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\net.exe' group /domain' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C net.exe stop foundation' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C sc delete foundation' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del <Full path to file> >> NUL' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\net.exe' group /domain
- '%WINDIR%\syswow64\net1.exe' group /domain
- '%WINDIR%\syswow64\cmd.exe' /C net.exe stop foundation
- '%WINDIR%\syswow64\cmd.exe' /C sc delete foundation
- '%WINDIR%\syswow64\sc.exe' delete foundation
- '%WINDIR%\syswow64\net1.exe' stop foundation
- '%WINDIR%\syswow64\cmd.exe' /c del <Full path to file> >> NUL
