Техническая информация
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\] 'MSSMSGS' = 'rundll32.exe winypt32.rom,fQsFzcQccS'
- iexplore.exe
- %TEMP%\awtbba.tmp
- %WINDIR%\syswow64\winypt32.rom
- %TEMP%\awtbba.bat
- %TEMP%\awtbba.tmp
- DNS ASK sa###oft.net
- ClassName: 'IEFrame' WindowName: ''
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\AwtBBA.bat"' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\AwtBBA.bat"