Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\wshcon] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\wshcon] 'ImagePath' = '"%WINDIR%\SysWOW64\ndfapi\wshcon.exe"'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABEAEEASgBWAEcAZAB0AHEAPQAnAFcAUQBLAFkAUQBiAG0AbgAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAGAAZQBjAHUAcgBpAHQAYABZAFAAcgBvAFQAbwBgAEMATwBMACIAIAA9AC...
- %HOMEPATH%\312.exe
- %HOMEPATH%\312.exe в %WINDIR%\syswow64\ndfapi\wshcon.exe
- '47.##6.117.214':80
- '62.##8.54.22':8080
- '21#.#1.142.238':8080
- '19#.#60.53.126':80
- '87.##6.136.232':8080
- '74.##8.45.104':8080
- '12#.#24.124.40':7080
- '12#.#5.106.173':443
- '76.##.179.47':80
- '21#.#65.156.91':80
- http://jd#####ronics.com.au/1e8nq_ij3_tq76ahy/
- http://47.##6.117.214/ZaJX4ZhuxMVeF8/
- http://21#.##.142.238:8080/zmh6gHhcivBo9c6/ccrb/ via 21#.#1.142.238
- http://12#.##.106.173:443/TNwRAsql/rkkJYiTR/L7RFn4bhRebiiD/ via 12#.#5.106.173
- http://76.##.179.47/aDkc5CnhHHl0ArjbHb/kAbt7LP/4KAp4Ovr/SgDKKsZP1IF4r/qUUakJIr30Gbw/
- DNS ASK jd#####ronics.com.au
- DNS ASK fo####jetivo.com
- '%HOMEPATH%\312.exe'
- '%WINDIR%\syswow64\ndfapi\wshcon.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABEAEEASgBWAEcAZAB0AHEAPQAnAFcAUQBLAFkAUQBiAG0AbgAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAGAAZQBjAHUAcgBpAHQAYABZAFAAcgBvAFQAbwBgAEMATwBMACIAIAA9AC...' (со скрытым окном)