Техническая информация
- %APPDATA%\microsoft\windows\start menu\programs\startup\avastt.vbs
- C:\users\public\avastt.ps1
- 're####r.gleeze.com':1177
- http://www.4u##.com/uploads/file_2020-04-07_132406.mp3
- http://www.4u##.com/uploads/file_2020-04-07_133721.mp3
- http://www.4u##.com/uploads/file_2020-04-07_133701.jpg
- DNS ASK 4u##.com
- DNS ASK re####r.gleeze.com
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -windo 1 -noexit -exec bypass -file "C:\Users\Public\avastt.ps1"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -windo 1 -noexit -exec bypass -file "C:\Users\Public\avastt.ps1"' (со скрытым окном)
- '<SYSTEM32>\wscript.exe' "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\avastt.vbs"