Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\captcha] 'Start' = '00000002'
- <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\captcha" /v Type /t REG_DWORD /d 288 /f
- <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\captcha" /v FailureActions /t REG_BINARY /d 00000000000000000000000003000000140000000100000060EA00000100000060EA00000100000060EA0000 /f
- <SYSTEM32>\rundll32.exe captcha,ServiceMain
- <SYSTEM32>\reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\svchost" /v captcha /t REG_MULTI_SZ /d "captcha\0" /f
- <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\captcha\parameters" /v ServiceDll /t REG_EXPAND_SZ /d "<SYSTEM32>\captcha.dll" /f
- <SYSTEM32>\cmd.exe /c "%temp%\captcha.bat"
- <SYSTEM32>\cmd.exe /c "<Полный путь к вирусу>" /res >%temp%\captcha.bat
- <SYSTEM32>\sc.exe create "captcha" type= share start= auto binPath= "<SYSTEM32>\svchost.exe -k captcha"
- <SYSTEM32>\netsh.exe firewall add allowedprogram name="captcha" program="<SYSTEM32>\svchost.exe" mode=ENABLE
- C:\captcha.log
- %TEMP%\captcha.bat
- <SYSTEM32>\captcha.dll