Sibot reaches out to a legitimate but compromised website to download a DLL to a folder under System32. The scheduled task calls an MSHTA application to run Sibot via the obfuscated script. The compromised website used to host the DLL is different for every compromised network and includes websites of medical device manufacturers and IT service providers