Техническая информация
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'rat_bait' = '<SYSTEM32>\evil.exe'
- <SYSTEM32>\owned.txt
- 'ma####ous-site.com':80
- 'q2.##otes.com':80
- 'fa###ntrk.com':443
- http://ma####ous-site.com/payload.exe
- http://q2.##otes.com/9646dca8-34fe-11f0-a86b-01ff450f3267
- 'fa###ntrk.com':443
- DNS ASK ma####ous-site.com
- DNS ASK q2.##otes.com
- DNS ASK fa###ntrk.com
- '<SYSTEM32>\cmd.exe' /c cmd /c echo downloading payload...
- '<SYSTEM32>\cmd.exe' /c echo downloading payload...