Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\reachmscms] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\reachmscms] 'ImagePath' = '"%WINDIR%\SysWOW64\reachmscms.exe"'
- '<SYSTEM32>\wisptis.exe' /ManualLaunch;
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -enco JABJAG8AdQBlAGIAYgBwAHEAdgBiAHUAPQAnAEoAYgBlAGgAaQBwAGMAYwB4AHYAcABjACcAOwAkAEYAcABuAHQAZQB2AHYAdgByAG4AIAA9ACAAJwA1ADUAOAAnADsAJABEAHIAdQBpAG0AcQBrAGcAdgBkAGQAPQAnAFAAcgBlAHYAYQB5AHUAdQB...
- %HOMEPATH%\558.exe
- %HOMEPATH%\558.exe в %WINDIR%\syswow64\reachmscms.exe
- http://ti###heus.ua/wp-content/zyul/
- http://67.###.179.64:8080/glitch/ via 67.##5.179.64
- DNS ASK ti###heus.ua
- '%HOMEPATH%\558.exe'
- '%WINDIR%\syswow64\reachmscms.exe'
- '<SYSTEM32>\wisptis.exe' /ManualLaunch;' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -enco JABJAG8AdQBlAGIAYgBwAHEAdgBiAHUAPQAnAEoAYgBlAGgAaQBwAGMAYwB4AHYAcABjACcAOwAkAEYAcABuAHQAZQB2AHYAdgByAG4AIAA9ACAAJwA1ADUAOAAnADsAJABEAHIAdQBpAG0AcQBrAGcAdgBkAGQAPQAnAFAAcgBlAHYAYQB5AHUAdQB...' (со скрытым окном)