Technical Information
- %APPDATA%\microsoft\windows\start menu\programs\startup\axvzqexboad.lnk
- %HOMEPATH%\appdata\axvzqexboad.vbs
- 'pa###bin.com':443
- DNS ASK pa###bin.com
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -noexit [Reflection.Assembly]::'Load'((Get-ItemProperty HKCU:\Software\wZbgxPTRAYTvU).BgTpRXOPhjK).'EntryPoint'.'Invoke'($Null,$Null)' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -noexit [Reflection.Assembly]::'Load'((Get-ItemProperty HKCU:\Software\wZbgxPTRAYTvU).BgTpRXOPhjK).'EntryPoint'.'Invoke'($Null,$Null)