Technical Information
- %TEMP%\yandex.exe
- '98#####3131d29cb.xyz':80
- http://98#####3131d29cb.xyz/step.php
- DNS ASK 98#####3131d29cb.xyz
- '%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 -n 3 & del "<Full path to file>"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 -n 3 & del "<Full path to file>"
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 3