Technical Information
Malicious functions:
Executes the following:
- <SYSTEM32>\wbem\scrcons.exe -Embedding
- <SYSTEM32>\wscript.exe "c:\19BE53BB.vbs"
Hides the following processes:
Modifies file system :
Creates the following files:
- C:\19BE53BB.vbs
- %WINDIR%\svchcst.exe
Deletes the following files:
- C:\19BE53BB.vbs
Network activity:
Connects to:
- 'cw##.3322.org':80
UDP:
- DNS ASK cw##.3322.org
- '<Private IP address>':1035
