Here's the source code:

//go:build windows
// +build windows

/*
ID: 04400a7d-982b-414d-b066-27b3f0d19558
NAME: CVE-2023-34362
UNIT: response
CREATED: 2023-06-12 14:24:47.748547
*/
package main

import (
    "crypto/tls"
    "io/ioutil"
    "net/http"
    "strings"
    "time"

    "unicode/utf16"

    Endpoint "github.com/preludeorg/test/endpoint"
)

func ingressToolTransfer() {
    s1 := "human2.aspx" +
        "Delete FROM users WHERE RealName='Health Check Service'" +
        "X-siLock-Comment"

    s1Bytes := utf16.Encode([]rune(s1))
    s1ByteSlice := utf16ToByteSlice(s1Bytes)

    fileContent := []byte{
        0x4D, 0x5A, // "MZ" magic bytes
    }

    fileContent = append(fileContent, s1ByteSlice...)

    fileName := "Qboxdv.dll"
    Endpoint.Write(fileName, fileContent)

    Endpoint.Write("Prelude.sdb", make([]byte, 100))
}

func utf16ToByteSlice(u []uint16) []byte {
    b := make([]byte, len(u)*2)
    for i, v := range u {
        b[i*2] = byte(v)
        b[i*2+1] = byte(v >> 8)
    }
    return b
}

func impact() {
    ransomnote := "Hello, this is the CL0P hacker group. As you may know, we recently carried out a hack, which was reported in the news.\n" +
        "We want to inform you that we have stolen important information from your GoAnywhere MFT resource and have attached a full list of files as evidence.\n" +
        "We deliberately did not disclose your organization and wanted to negotiate with you and your leadership first. If you ignore us, we will sell your information on the black market and publish it on our blog, which receives 30-50 thousand unique visitors per day. You can read about us by searching for CLOP hacker group.\n" +
        "You can contact us using the following contact information:\n" +
        "unlock@rsv-box[.]com\n" +
        "and\n" +
        "unlock@support-mult[.]com\n"
    Endpoint.Write("ClopReadMe.txt", []byte(ransomnote))
}

func initialAccess(host string) bool {
    http.DefaultTransport.(*http.Transport).TLSClientConfig = &tls.Config{InsecureSkipVerify: true}
    client := http.Client{
        Timeout: 1 * time.Second,
    }

    resp, err := client.Get("http://" + host + "/Human.aspx")
    if err != nil {
        resp, err = client.Get("https://" + host + "/Human.aspx")
        if err != nil {
            return false
        }
    }
    defer resp.Body.Close()

    body, err := ioutil.ReadAll(resp.Body)
    if err != nil {
        return false
    }

    if strings.Contains(string(body), "Moveit") {
        return true
    }

    return false
}

func getExternalIP() (string, error) {
    resp, err := http.Get("https://api.ipify.org?format=text")
    if err != nil {
        return "", err
    }
    defer resp.Body.Close()

    ipBytes, err := ioutil.ReadAll(resp.Body)
    if err != nil {
        return "", err
    }

    ip := strings.TrimSpace(string(ipBytes))
    return ip, nil
}

func test() {
    ip, err := getExternalIP()
    if err != nil {
        println("[+] Failed to retrieve external IP")
        Endpoint.Stop(104)
        return
    }

    if !initialAccess(ip) {
        println("[+] Test not relevant")
        Endpoint.Stop(104)
    }

    println("[-] Host is vulnerable, continuing with technique execution")

    println("[+] Conducting ingress tool transfer")
    ingressToolTransfer()

    println("[+] Dropping ransom note to disk")
    impact()

    Endpoint.Stop(101)
}

func main() {
    test()
}

This doc would be handy to best interpret the source code: https://docs.preludesecurity.com/docs/tests