Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\streametheriumlifeg
Modifies file system
Deletes itself.
Network activity
Connects to
- 'ip##pi.com':80
- 'st####ommunity.com':443
- 'ni###icc.com':4545
TCP
HTTP GET requests
- http://www.ip##pi.com/line/?fi###########
Other
- 'st####ommunity.com':443
- 'ni###icc.com':4545
UDP
- DNS ASK ip##pi.com
- DNS ASK st####ommunity.com
- DNS ASK ni###icc.com
Miscellaneous
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Start-Sleep -Seconds 3; Remove-Item -Path <Full path to file> -Force
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' ' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Start-Sleep -Seconds 3; Remove-Item -Path <Full path to file> -Force' (with hidden window)
