Technical Information
- '' (downloaded from the Internet)
- 'C:\users\public\vbc.exe'
- vbc.exe
- C:\users\public\vbc.exe
- %APPDATA%\microsoft\windows\start menu\programs\shfaxz\pgoxatb.exe
- %ALLUSERSPROFILE%\remcos\logs.dat
- '21#.#46.108.73':80
- 'in#####kaps.ddns.net':6838
- http://21#.#46.108.73/55/vbc.exe
- 'in#####kaps.ddns.net':6838
- DNS ASK in#####kaps.ddns.net
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==' (with hidden window)
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==