hmm so I wonder is the mp3 included in the payload or does it pull it down after infection? OR... does it search the network for it and proceeds to copy it to all systems that are compromised???

These are the questions I need answered!!!
But yeah so far no actual code confirmation.